Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Hwacaj.exe

Overview

General Information

Sample name:Hwacaj.exe
Analysis ID:1581649
MD5:9f8aba858f3a742000b8d2cdf3e96aee
SHA1:c2a1bc3f2358c62aa58e36e69347ff756214d495
SHA256:0960360752ddc41534ac5635a616604e4778ade10b8d246c6a7a745c44285be1
Infos:

Detection

Darkbot
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for submitted file
Yara detected Darkbot
AI detected suspicious sample
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found API chain indicative of debugger detection
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking system information)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Changes the start page of internet explorer
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to get notified if a device is plugged in / out
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w7x64
  • Hwacaj.exe (PID: 3532 cmdline: "C:\Users\user\Desktop\Hwacaj.exe" MD5: 9F8ABA858F3A742000B8D2CDF3E96AEE)
    • notepad.exe (PID: 3544 cmdline: "C:\Windows\notepad.exe" MD5: B32189BDFF6E577A92BAA61AD49264E6)
    • Hwacaj.exe (PID: 3556 cmdline: "C:\Users\user\Desktop\Hwacaj.exe" MD5: 9F8ABA858F3A742000B8D2CDF3E96AEE)
      • iexplore.exe (PID: 3628 cmdline: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" MD5: 8A590F790A98F3D77399BE457E01386A)
        • iexplore.exe (PID: 3636 cmdline: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" MD5: 4EB098135821348270F27157F7A84E65)
          • iexplore.exe (PID: 3732 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:275457 /prefetch:2 MD5: 8A590F790A98F3D77399BE457E01386A)
      • WmiPrvSE.exe (PID: 2004 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 54B7C43C2E89F5CE71B2C255C1CF35E2)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1272 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 652 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1696 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 628 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1376 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1784 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 436 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1628 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1808 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 848 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2880 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2872 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2836 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2712 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2736 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2892 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 3036 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2052 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2664 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1076 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1448 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2468 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1372 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2344 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1212 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1468 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2184 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2188 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2908 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2920 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2244 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 2180 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • LMrDJmjGiVuMmdtVXtMTEmE.exe (PID: 1440 cmdline: "C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: Hwacaj.exe PID: 3532JoeSecurity_DarkbotYara detected DarkbotJoe Security
    Process Memory Space: Hwacaj.exe PID: 3556JoeSecurity_DarkbotYara detected DarkbotJoe Security
      Process Memory Space: iexplore.exe PID: 3732JoeSecurity_DarkbotYara detected DarkbotJoe Security
        Process Memory Space: WmiPrvSE.exe PID: 2004JoeSecurity_DarkbotYara detected DarkbotJoe Security
          Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1272JoeSecurity_DarkbotYara detected DarkbotJoe Security
            Click to see the 32 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Modification of IE Registry Settings
            Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 3636, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: Hwacaj.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: Hwacaj.exeVirustotal: Detection: 88%Perma Link
            Source: Hwacaj.exeReversingLabs: Detection: 100%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 89.0% probability
            Machine Learning detection for sample
            Source: Hwacaj.exeJoe Sandbox ML: detected
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00408C90 memset,WSAGetLastError,DecryptMessage,2_2_00408C90
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00401EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,2_2_00401EA0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00408B30 memset,EncryptMessage,2_2_00408B30
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E28B30 memset,EncryptMessage,7_2_05E28B30
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E21EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,7_2_05E21EA0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E28C90 memset,WSAGetLastError,DecryptMessage,7_2_05E28C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_00198C90 memset,WSAGetLastError,DecryptMessage,10_2_00198C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_00191EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,10_2_00191EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_00198B30 memset,EncryptMessage,10_2_00198B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_00391EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,11_2_00391EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_00398C90 memset,WSAGetLastError,DecryptMessage,11_2_00398C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_00398B30 memset,EncryptMessage,11_2_00398B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00108C90 memset,WSAGetLastError,DecryptMessage,12_2_00108C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00101EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,12_2_00101EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00108B30 memset,EncryptMessage,12_2_00108B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00251EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,13_2_00251EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00258C90 memset,WSAGetLastError,DecryptMessage,13_2_00258C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00258B30 memset,EncryptMessage,13_2_00258B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00108C90 memset,WSAGetLastError,DecryptMessage,14_2_00108C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00101EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,14_2_00101EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00108B30 memset,EncryptMessage,14_2_00108B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00548C90 memset,WSAGetLastError,DecryptMessage,15_2_00548C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00541EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,15_2_00541EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00548B30 memset,EncryptMessage,15_2_00548B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00148C90 memset,WSAGetLastError,DecryptMessage,16_2_00148C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00141EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,16_2_00141EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00148B30 memset,EncryptMessage,16_2_00148B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B8C90 memset,WSAGetLastError,DecryptMessage,17_2_001B8C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,17_2_001B1EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B8B30 memset,EncryptMessage,17_2_001B8B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00178C90 memset,WSAGetLastError,DecryptMessage,18_2_00178C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00171EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,18_2_00171EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00178B30 memset,EncryptMessage,18_2_00178B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00178C90 memset,WSAGetLastError,DecryptMessage,19_2_00178C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00171EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,19_2_00171EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00178B30 memset,EncryptMessage,19_2_00178B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00271EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,20_2_00271EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00278C90 memset,WSAGetLastError,DecryptMessage,20_2_00278C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00278B30 memset,EncryptMessage,20_2_00278B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00158C90 memset,WSAGetLastError,DecryptMessage,21_2_00158C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00151EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,21_2_00151EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00158B30 memset,EncryptMessage,21_2_00158B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00548C90 memset,WSAGetLastError,DecryptMessage,22_2_00548C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00541EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,22_2_00541EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00548B30 memset,EncryptMessage,22_2_00548B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00271EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,23_2_00271EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00278C90 memset,WSAGetLastError,DecryptMessage,23_2_00278C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00278B30 memset,EncryptMessage,23_2_00278B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00351EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,24_2_00351EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00358C90 memset,WSAGetLastError,DecryptMessage,24_2_00358C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00358B30 memset,EncryptMessage,24_2_00358B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00168C90 memset,WSAGetLastError,DecryptMessage,25_2_00168C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00161EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,25_2_00161EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00168B30 memset,EncryptMessage,25_2_00168B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00108C90 memset,WSAGetLastError,DecryptMessage,26_2_00108C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00101EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,26_2_00101EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00108B30 memset,EncryptMessage,26_2_00108B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00371EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,27_2_00371EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00378C90 memset,WSAGetLastError,DecryptMessage,27_2_00378C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00378B30 memset,EncryptMessage,27_2_00378B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00331EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,28_2_00331EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00338C90 memset,WSAGetLastError,DecryptMessage,28_2_00338C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00338B30 memset,EncryptMessage,28_2_00338B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00371EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,29_2_00371EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00378C90 memset,WSAGetLastError,DecryptMessage,29_2_00378C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00378B30 memset,EncryptMessage,29_2_00378B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_00291EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,30_2_00291EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_00298C90 memset,WSAGetLastError,DecryptMessage,30_2_00298C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_00298B30 memset,EncryptMessage,30_2_00298B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00601EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,31_2_00601EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00608C90 memset,WSAGetLastError,DecryptMessage,31_2_00608C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00608B30 memset,EncryptMessage,31_2_00608B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_00098C90 memset,WSAGetLastError,DecryptMessage,32_2_00098C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_00091EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,32_2_00091EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_00098B30 memset,EncryptMessage,32_2_00098B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,33_2_002A1EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A8C90 memset,WSAGetLastError,DecryptMessage,33_2_002A8C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A8B30 memset,EncryptMessage,33_2_002A8B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00548C90 memset,WSAGetLastError,DecryptMessage,34_2_00548C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00541EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,34_2_00541EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00548B30 memset,EncryptMessage,34_2_00548B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00271EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,35_2_00271EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00278C90 memset,WSAGetLastError,DecryptMessage,35_2_00278C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00278B30 memset,EncryptMessage,35_2_00278B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A8C90 memset,WSAGetLastError,DecryptMessage,36_2_001A8C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,36_2_001A1EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A8B30 memset,EncryptMessage,36_2_001A8B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00148C90 memset,WSAGetLastError,DecryptMessage,37_2_00148C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00141EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,37_2_00141EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00148B30 memset,EncryptMessage,37_2_00148B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00221EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,38_2_00221EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00228C90 memset,WSAGetLastError,DecryptMessage,38_2_00228C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00228B30 memset,EncryptMessage,38_2_00228B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_00188C90 memset,WSAGetLastError,DecryptMessage,39_2_00188C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_00181EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,39_2_00181EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_00188B30 memset,EncryptMessage,39_2_00188B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_00341EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,40_2_00341EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_00348C90 memset,WSAGetLastError,DecryptMessage,40_2_00348C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_00348B30 memset,EncryptMessage,40_2_00348B30
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B8C90 memset,WSAGetLastError,DecryptMessage,41_2_008B8C90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,41_2_008B1EA0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B8B30 memset,EncryptMessage,41_2_008B8B30

            Compliance

            barindex
            Detected unpacking (creates a PE file in dynamic memory)
            Source: C:\Users\user\Desktop\Hwacaj.exeUnpacked PE file: 2.2.Hwacaj.exe.890000.1.unpack
            Detected unpacking (overwrites its own PE header)
            Source: C:\Users\user\Desktop\Hwacaj.exeUnpacked PE file: 2.2.Hwacaj.exe.400000.0.unpack
            Source: Hwacaj.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dllJump to behavior
            Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.22:49182 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.22:49181 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 18.161.69.8:443 -> 192.168.2.22:49179 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 18.161.69.8:443 -> 192.168.2.22:49180 version: TLS 1.2
            Source: Binary string: 86\ship\0\msohev.dll\bbtopt\msohevO.pdb source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmp
            Source: Binary string: t:\misc_hev\x86\ship\0\msohev.pdb86\ship\0\msohev.dll\bbtopt\msohevO.pdb source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmp
            Source: Binary string: t:\misc_urlredirection\x86\ship\0\urlredirection.pdb0\urlredirection.dll\bbtopt\urlredirectionO.pdb source: iexplore.exe, 00000007.00000002.628840238.0000000065C61000.00000020.00000001.01000000.0000000D.sdmp
            Source: Binary string: t:\misc_urlredirection\x86\ship\0\urlredirection.pdb source: iexplore.exe, 00000007.00000002.628840238.0000000065C61000.00000020.00000001.01000000.0000000D.sdmp
            Source: Binary string: t:\misc_hev\x86\ship\0\msohev.pdb source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000000.358163038.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000000.358303491.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000000.358449372.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.619880696.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000000.358747147.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.620413068.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.619450317.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.620547861.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000000.360220245.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000000.360351050.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.619654570.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000000.360680304.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000000.360806713.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.619780142.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.620407592.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.620542679.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000000.362632168.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000000.362935110.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000000.363152176.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000000.363781936.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.619899409.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.620536802.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000000.365121496.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.619873693.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000000.365499580.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmd
            Source: Binary string: 0\urlredirection.dll\bbtopt\urlredirectionO.pdb source: iexplore.exe, 00000007.00000002.628840238.0000000065C61000.00000020.00000001.01000000.0000000D.sdmp
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E2FB60 RegisterClassExA,CreateWindowExA,RegisterDeviceNotificationA,GetMessageA,GetMessageA,TranslateMessage,TranslateMessage,DispatchMessageA,GetMessageA,7_2_05E2FB60
            Source: Hwacaj.exe, 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: [autorun]
            Source: Hwacaj.exe, 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: %sautorun.inf
            Source: Hwacaj.exe, 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: Hwacaj.exe, 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: shellexecute=[autorun]
            Source: Hwacaj.exe, 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: Hwacaj.exeBinary or memory string: %sautorun.inf
            Source: Hwacaj.exeBinary or memory string: [autorun]
            Source: Hwacaj.exeBinary or memory string: autorun.inf
            Source: Hwacaj.exe, 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: Hwacaj.exe, 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: Hwacaj.exe, 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: Hwacaj.exe, 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: Hwacaj.exe, 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: Hwacaj.exe, 00000002.00000003.370012958.000000000066E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: Hwacaj.exe, 00000002.00000003.370012958.000000000066E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: Hwacaj.exe, 00000002.00000003.370012958.000000000066E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: Hwacaj.exe, 00000002.00000003.370012958.000000000066E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: Hwacaj.exe, 00000002.00000003.370012958.000000000066E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: Hwacaj.exe, 00000002.00000002.370757434.0000000000890000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: Hwacaj.exe, 00000002.00000002.370757434.0000000000890000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: Hwacaj.exe, 00000002.00000002.370757434.0000000000890000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: Hwacaj.exe, 00000002.00000002.370757434.0000000000890000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: Hwacaj.exe, 00000002.00000002.370757434.0000000000890000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: iexplore.exeBinary or memory string: autorun.inf
            Source: iexplore.exeBinary or memory string: [autorun]
            Source: iexplore.exeBinary or memory string: %sautorun.inf
            Source: iexplore.exe, 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: iexplore.exe, 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: iexplore.exe, 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: iexplore.exe, 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: iexplore.exe, 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: WmiPrvSE.exe, 00000009.00000003.358058665.0000000001270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: WmiPrvSE.exe, 00000009.00000003.358058665.0000000001270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: WmiPrvSE.exe, 00000009.00000003.358058665.0000000001270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: WmiPrvSE.exe, 00000009.00000003.358058665.0000000001270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: WmiPrvSE.exe, 00000009.00000003.358058665.0000000001270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000002.616865045.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000002.616865045.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000002.616865045.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000002.616865045.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000002.616865045.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.616902676.0000000000250000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.616902676.0000000000250000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.616902676.0000000000250000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.616902676.0000000000250000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.616902676.0000000000250000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000002.616823533.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000002.616823533.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000002.616823533.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000002.616823533.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000002.616823533.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.618555465.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.618555465.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.618555465.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.618555465.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.618555465.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.616752254.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.616752254.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.616752254.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.616752254.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.616752254.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.617482619.00000000001B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.617482619.00000000001B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.617482619.00000000001B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.617482619.00000000001B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.617482619.00000000001B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000002.616996605.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000002.616996605.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000002.616996605.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000002.616996605.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000002.616996605.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000002.616897608.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000002.616897608.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000002.616897608.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000002.616897608.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000002.616897608.0000000000170000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.617179032.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.617179032.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.617179032.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.617179032.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.617179032.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000002.617031006.0000000000150000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000002.617031006.0000000000150000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000002.617031006.0000000000150000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000002.617031006.0000000000150000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000002.617031006.0000000000150000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000002.618238383.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000002.618238383.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000002.618238383.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000002.618238383.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000002.618238383.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.617160452.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.617160452.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.617160452.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.617160452.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.617160452.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.617887080.0000000000350000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.617887080.0000000000350000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.617887080.0000000000350000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.617887080.0000000000350000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.617887080.0000000000350000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.617049513.0000000000160000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.617049513.0000000000160000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.617049513.0000000000160000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.617049513.0000000000160000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.617049513.0000000000160000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000002.616944398.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000002.616944398.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000002.616944398.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000002.616944398.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000002.616944398.0000000000100000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000002.618239734.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000002.618239734.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000002.618239734.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000002.618239734.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000002.618239734.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000002.617659956.0000000000330000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000002.617659956.0000000000330000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000002.617659956.0000000000330000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000002.617659956.0000000000330000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000002.617659956.0000000000330000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000002.617284353.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000002.617284353.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000002.617284353.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000002.617284353.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000002.617284353.0000000000370000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.617219817.0000000000290000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.617219817.0000000000290000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.617219817.0000000000290000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.617219817.0000000000290000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.617219817.0000000000290000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.618437896.0000000000600000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.618437896.0000000000600000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.618437896.0000000000600000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.618437896.0000000000600000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.618437896.0000000000600000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000002.616793620.0000000000090000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000002.616793620.0000000000090000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000002.616793620.0000000000090000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000002.616793620.0000000000090000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000002.616793620.0000000000090000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.617155240.00000000002A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.617155240.00000000002A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.617155240.00000000002A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.617155240.00000000002A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.617155240.00000000002A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000002.618152185.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000002.618152185.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000002.618152185.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000002.618152185.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000002.618152185.0000000000540000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000023.00000002.617099906.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000023.00000002.617099906.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000023.00000002.617099906.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000023.00000002.617099906.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000023.00000002.617099906.0000000000270000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000024.00000002.617581120.00000000001A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000024.00000002.617581120.00000000001A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000024.00000002.617581120.00000000001A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000024.00000002.617581120.00000000001A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000024.00000002.617581120.00000000001A0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000025.00000002.617023633.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000025.00000002.617023633.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000025.00000002.617023633.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000025.00000002.617023633.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000025.00000002.617023633.0000000000140000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000026.00000002.617204167.0000000000220000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000026.00000002.617204167.0000000000220000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000026.00000002.617204167.0000000000220000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000026.00000002.617204167.0000000000220000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000026.00000002.617204167.0000000000220000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000027.00000002.617085624.0000000000180000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000027.00000002.617085624.0000000000180000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000027.00000002.617085624.0000000000180000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000027.00000002.617085624.0000000000180000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000027.00000002.617085624.0000000000180000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000028.00000002.617707131.0000000000340000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000028.00000002.617707131.0000000000340000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000028.00000002.617707131.0000000000340000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000028.00000002.617707131.0000000000340000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000028.00000002.617707131.0000000000340000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: autorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exeBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000029.00000002.618608162.00000000008B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000029.00000002.618608162.00000000008B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000029.00000002.618608162.00000000008B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000029.00000002.618608162.00000000008B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000029.00000002.618608162.00000000008B0000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000002A.00000002.618555175.0000000000790000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000002A.00000002.618555175.0000000000790000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: %sautorun.inf
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000002A.00000002.618555175.0000000000790000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]*members*.iknowthatgirl*/members*IKnowThatGirl*youporn.*/login*YouPorn*members.brazzers.com*BrazzersclavenumeroTarjeta*clave=**bcointernacional*login*Bcointernacional*:2222/CMD_LOGIN**whcms*dologin**:2086/login**:2083/login**:2082/login**webnames.ru/*user_login*Webnames*dotster.com/*login*Dotsterloginid*enom.com/login*Enomlogin.Passlogin.User*login.Pass=**1and1.com/xml/config*1and1token*moniker.com/*Login*MonikerLoginPasswordLoginUserName*LoginPassword=**namecheap.com/*login*Namecheaploginname*godaddy.com/login*GodaddyPasswordEmailName*Password=**alertpay.com/login*Alertpay*netflix.com/*ogin*Netflix*thepiratebay.org/login*Thepiratebay*torrentleech.org/*login*Torrentleech*vip-file.com/*/signin-do*Vip-filepaslog*pas=**sms4file.com/*/signin-do*Sms4file*letitbit.net*Letitbit*what.cd/login*Whatcd*oron.com/login*Oron*filesonic.com/*login*Filesonic*speedyshare.com/login*Speedysharepwid*pw=**uploaded.to/*login*Uploaded*uploading.com/*login*UploadingloginUserPasswordloginUserName*loginUserPassword=**fileserv.com/login*Fileserve*hotfile.com/login*Hotfile*4shared.com/login*4sharedtxtpasstxtuser*txtpass=**netload.in/index*Netload*freakshare.com/login*Freaksharelogin_pass*login_pass=**mediafire.com/*login*Mediafire*sendspace.com/login*Sendspace*megaupload.*/*login*Mega
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000002A.00000002.618555175.0000000000790000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: shellexecute=[autorun]
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000002A.00000002.618555175.0000000000790000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s*\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-text*bebo.*/c/home/ajax_post_lifestream_commentbebo Lifestream*bebo.*/c/profile/comment_post.jsonbebo CommentMessage*bebo.*/mail/MailCompose.jsp*bebo Message*friendster.*/sendmessage.php*Friendster MessagecommentFriendster Commentshoutout*friendster.*/rpc.phpFriendster Shoutout*vkontakte.ru/mail.phpvkontakte Message*vkontakte.ru/wall.phpvkontakte Wallmessage*vkontakte.ru/api.phpvkontakte Chattext*twitter.*/*direct_messages/new*Twitter Message*twitter.*/*status*/update*Twitter Tweetstatus*facebook.*/ajax/*MessageComposerEndpoint.php*Facebook Messagemsg_text*facebook.*/ajax/chat/send.php*Facebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,2_2_0040F130
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E2F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,7_2_05E2F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_0019F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,10_2_0019F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_0039F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,11_2_0039F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,12_2_0010F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_0025F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,13_2_0025F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,14_2_0010F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_0054F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,15_2_0054F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_0014F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,16_2_0014F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001BF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,17_2_001BF130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_0017F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,18_2_0017F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_0017F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,19_2_0017F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_0027F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,20_2_0027F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_0015F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,21_2_0015F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_0054F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,22_2_0054F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_0027F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,23_2_0027F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_0035F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,24_2_0035F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_0016F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,25_2_0016F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,26_2_0010F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_0037F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,27_2_0037F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_0033F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,28_2_0033F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_0037F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,29_2_0037F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_0029F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,30_2_0029F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_0060F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,31_2_0060F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,32_2_0009F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002AF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,33_2_002AF130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_0054F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,34_2_0054F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_0027F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,35_2_0027F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001AF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,36_2_001AF130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_0014F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,37_2_0014F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_0022F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,38_2_0022F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_0018F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,39_2_0018F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_0034F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,40_2_0034F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008BF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,41_2_008BF130
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040F9E0 memset,GetLogicalDriveStringsA,lstrcatA,lstrcatA,2_2_0040F9E0
            Source: Joe Sandbox ViewIP Address: 151.101.66.137 151.101.66.137
            Source: Joe Sandbox ViewIP Address: 151.101.66.137 151.101.66.137
            Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00408270 GetTickCount,GetTickCount,GetTickCount,select,select,closesocket,select,recv,send,inet_ntoa,htons,send,LocalAlloc,LocalFree,2_2_00408270
            Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\favicon[1].icoJump to behavior
            Source: global trafficHTTP traffic detected: GET /jquery-3.6.3.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: code.jquery.comDNT: 1Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /b?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sb.scorecardresearch.comDNT: 1Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /b2?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sb.scorecardresearch.comDNT: 1Connection: Keep-Alive
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
            Source: global trafficDNS traffic detected: DNS query: www.msn.com
            Source: global trafficDNS traffic detected: DNS query: assets.msn.com
            Source: global trafficDNS traffic detected: DNS query: c.msn.com
            Source: global trafficDNS traffic detected: DNS query: sb.scorecardresearch.com
            Source: global trafficDNS traffic detected: DNS query: code.jquery.com
            Source: global trafficDNS traffic detected: DNS query: browser.events.data.msn.com
            Source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmpString found in binary or memory: http://.exe
            Source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000002A.00000002.618555175.0000000000790000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://api.wipmania.com/
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://go.microsof
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
            Source: iexplore.exe, 00000007.00000002.625846589.0000000005ACB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pravo.gov.ru/proxy/ips/?docbody=&link_id=2&nd=102144583&intelsearch=&lastDoc=1
            Source: imagestore.dat.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
            Source: iexplore.exe, 00000007.00000002.623584967.000000000415D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.c
            Source: iexplore.exe, 00000007.00000002.626044722.0000000005B90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.cn
            Source: iexplore.exe, 00000007.00000003.373971071.0000000004BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/4
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/B
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/K
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/P
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/mi
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370476989.00000000050D4000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B17000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js=
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js=o(
            Source: iexplore.exe, 00000007.00000003.373729371.00000000050D4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000050D2000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370476989.00000000050D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsWi
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsjsf
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsn(63
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsotyp
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js-
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js=n
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.jsct
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.jsen
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js)
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js18)
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js7
            Source: iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsC:
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsL
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jse
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsf
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsi
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jso.v
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/ven
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js.
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js3
            Source: iexplore.exe, 00000007.00000003.373761462.0000000004B0D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373988174.0000000004B0D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js30
            Source: iexplore.exe, 00000007.00000002.623498708.0000000004005000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jshttps://as
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jst
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jsta
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/lest/midlevel/microsoft.b109cceab5e009228460.js
            Source: iexplore.exe, 00000007.00000003.373761462.0000000004ADA000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623498708.000000000400E000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373926600.0000000004B05000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.625970785.0000000005B50000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626883358.00000000066CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/
            Source: iexplore.exe, 00000007.00000003.382630517.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/&ocid=iehp&os=windows&loc
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373971071.0000000004BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/&ocid=iehp&os=windows&locale=
            Source: iexplore.exe, 00000007.00000002.624048217.000000000483B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/D
            Source: iexplore.exe, 00000007.00000002.627629460.0000000006AA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/service/MSN/Feed/me?$top=32&DisableTypeSerialization=true&activityId=7FF05383
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics//pr
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036AC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png)
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.pngs6
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/Icon.png
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/Icon.pngC
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040DC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626914244.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036AC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.png
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngl
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngy
            Source: iexplore.exe, 00000007.00000003.510125439.0000000007268000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626914244.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.625603862.0000000005848000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.628358334.0000000007268000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.524419038.0000000005848000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.png
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngK
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngX
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngY
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626914244.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png/
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png8
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.pngc7
            Source: iexplore.exe, 00000007.00000002.625943506.0000000005B35000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.comhttps://assets.msn.cn
            Source: iexplore.exe, 00000007.00000002.624048217.000000000483B000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623498708.0000000003FF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/
            Source: iexplore.exe, 00000007.00000002.626044722.0000000005B90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.comi
            Source: iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.coml
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://browser.events.data.msn.com/
            Source: iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0
            Source: iexplore.exe, 00000007.00000003.392852147.0000000006BC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-strea
            Source: iexplore.exe, 00000007.00000002.626883358.00000000066C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://c.microsoftstart.cn/c.gif
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/R
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004BEA000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000050D2000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036B6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/c.gif?rnd=1735384141982&udc=true&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&rf=&tp=ht
            Source: iexplore.exe, 00000007.00000003.392763745.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/c.gifhttps://c.msn.cn/c.gif
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/d
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/v
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://code.jquery.com/
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.627071460.0000000006782000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626936808.000000000672C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.js
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsmillis:
            Source: iexplore.exe, 00000007.00000003.382630517.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsn.
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jstandard
            Source: iexplore.exe, 00000007.00000003.382630517.0000000004B71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jste
            Source: iexplore.exe, 00000007.00000003.370598320.0000000004BAB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report
            Source: iexplore.exe, 00000007.00000002.624817462.000000000521A000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040DC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382630517.0000000004BE6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.0000000004194000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004ADA000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370598320.0000000004BAB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382576586.0000000005212000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382204227.0000000005271000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000052B0000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
            Source: iexplore.exe, 00000007.00000003.373992715.0000000004B0E000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373988174.0000000004B0D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ent-api.msn.
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373971071.0000000004BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ent-api.msn.com/
            Source: iexplore.exe, 00000007.00000002.623930907.00000000045B1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ent-api.msn.com/M
            Source: iexplore.exe, 00000007.00000002.626968485.000000000674A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://events-sandbox.data.microsoftstart.cn/OneCollector/1.0https://browser.events.data.microsofts
            Source: iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://events-sandbox.data.msn.cn/OneCollector/1.0
            Source: iexplore.exe, 00000007.00000002.627122752.00000000067AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://events-sandbox.data.msn.com/OneCollector/1.0https://browser.events.data.msn.cn/OneCollector/
            Source: iexplore.exe, 00000007.00000002.625970785.0000000005B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://msn.com/en-us/news/us/about-us/ar-BBN0NAK
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/7
            Source: iexplore.exe, 00000007.00000002.624817462.00000000051C8000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.0000000005200000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/b2?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/b?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.m
            Source: iexplore.exe, 00000007.00000002.627122752.00000000067A0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/bhttps://c.microsoftstart.com/c.gif
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/y
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
            Source: iexplore.exe, 00000007.00000003.392763745.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626061768.0000000005BA6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382576586.0000000005212000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382204227.0000000005271000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AC1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036B9000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/
            Source: iexplore.exe, 00000007.00000002.624817462.00000000050A5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?o
            Source: iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382576586.0000000005200000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370476989.00000000050D4000.00000004.00000001.00020000.00000000.sdmp, ~DF7DCABBC5A497C821.TMP.5.dr, {1D7CEBF6-C50C-11EF-8F38-ECF4BBB5915B}.dat.5.drString found in binary or memory: https://www.msn.com/?ocid=iehp
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp#
            Source: iexplore.exe, 00000007.00000003.373761462.0000000004B0D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373926600.0000000004B05000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370598320.0000000004BAB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382535000.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382630517.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373988174.0000000004B0D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp#lang=en-us&adsReferer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp&devi
            Source: iexplore.exe, 00000007.00000003.370649049.0000000004BA4000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp(
            Source: iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp.
            Source: iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp...
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp.dlll
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp3.6.3.min.js693935/IE11NTP/desktop-shape.png
            Source: iexplore.exe, 00000007.00000002.622848077.00000000036B9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp8A/f
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp9d3d
            Source: iexplore.exe, 00000007.00000002.624817462.0000000005060000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp;
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpB889AE3
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpC:
            Source: iexplore.exe, 00000007.00000002.627422448.0000000006960000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpHJqeE
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMSN3
            Source: iexplore.exe, 00000007.00000002.620364847.00000000026D0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpSat
            Source: iexplore.exe, 00000007.00000002.626936808.0000000006725000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpTelemetryInitOptions.getbatchSendScrollLoadTimeEventr
            Source: iexplore.exe, 00000007.00000002.626044722.0000000005B97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpe.prototype.tryReformatGuid
            Source: iexplore.exe, 00000007.00000003.373992715.0000000004B0E000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B0D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373988174.0000000004B0D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpents.l
            Source: iexplore.exe, 00000007.00000002.623187024.0000000003843000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehphttps://www.msn.com/?ocid=iehp
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehplorer
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpn
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp6
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpr=n(26
            Source: iexplore.exe, 00000007.00000003.373761462.0000000004B17000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpr=n(26Q#1
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehps
            Source: iexplore.exe, 00000007.00000002.620364847.00000000026D0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpstorageTeststorageTest1220.296
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpv1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js
            Source: iexplore.exe, 00000007.00000002.627122752.00000000067AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/PV.xmlMS.News.Web.AppErrorDiagMS.News.Web.AdImpressionMS.News.Web.LoadTimeDiag8
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/R7
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/Uy
            Source: iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/nachrichten/topgeschichten/impressum/ar-BB5wWbz
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000050A5000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.0000000005200000.00000004.00000001.00020000.00000000.sdmp, imagestore.dat.7.drString found in binary or memory: https://www.msn.com/favicon.ico
            Source: iexplore.exe, 00000007.00000002.624817462.0000000005200000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico;b
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoc
            Source: iexplore.exe, 00000007.00000002.626883358.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000050D2000.00000004.00000001.00020000.00000000.sdmp, experience.b374b0d5b40196862f17[1].js.7.drString found in binary or memory: https://www.msn.com/fr-ch/actualite/other/Mentions-l
            Source: iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/fr-fr/actualite/microsoftnews/qui-sommes-nous/ar-AA135Z7yhttps://www.msn.com/de-
            Source: iexplore.exe, 00000007.00000002.626883358.00000000066C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/id-id/berita/nasional/tentang-kami/ar-BBca8ZEhttps://www.msn.com/it-it/notizie/m
            Source: iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/ocid=iehp
            Source: iexplore.exe, 00000007.00000002.624211070.0000000004C64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com6
            Source: iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.comin
            Source: iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.comream
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.comreammt
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49179
            Source: unknownNetwork traffic detected: HTTP traffic on port 49180 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49181 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49182 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49182
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49181
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49180
            Source: unknownNetwork traffic detected: HTTP traffic on port 49179 -> 443
            Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.22:49182 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.22:49181 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 18.161.69.8:443 -> 192.168.2.22:49179 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 18.161.69.8:443 -> 192.168.2.22:49180 version: TLS 1.2

            Operating System Destruction

            barindex
            Contains functionality to access PhysicalDrive, possible boot sector overwrite
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00409D90 CreateFileA on filename \\.\PHYSICALDRIVE02_2_00409D90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E29D90 CreateFileA on filename \\.\PHYSICALDRIVE07_2_05E29D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_00199D90 CreateFileA on filename \\.\PHYSICALDRIVE010_2_00199D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_00399D90 CreateFileA on filename \\.\PHYSICALDRIVE011_2_00399D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00109D90 CreateFileA on filename \\.\PHYSICALDRIVE012_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00259D90 CreateFileA on filename \\.\PHYSICALDRIVE013_2_00259D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00109D90 CreateFileA on filename \\.\PHYSICALDRIVE014_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00549D90 CreateFileA on filename \\.\PHYSICALDRIVE015_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00149D90 CreateFileA on filename \\.\PHYSICALDRIVE016_2_00149D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B9D90 CreateFileA on filename \\.\PHYSICALDRIVE017_2_001B9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00179D90 CreateFileA on filename \\.\PHYSICALDRIVE018_2_00179D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00179D90 CreateFileA on filename \\.\PHYSICALDRIVE019_2_00179D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00279D90 CreateFileA on filename \\.\PHYSICALDRIVE020_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00159D90 CreateFileA on filename \\.\PHYSICALDRIVE021_2_00159D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00549D90 CreateFileA on filename \\.\PHYSICALDRIVE022_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00279D90 CreateFileA on filename \\.\PHYSICALDRIVE023_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00359D90 CreateFileA on filename \\.\PHYSICALDRIVE024_2_00359D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00169D90 CreateFileA on filename \\.\PHYSICALDRIVE025_2_00169D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00109D90 CreateFileA on filename \\.\PHYSICALDRIVE026_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00379D90 CreateFileA on filename \\.\PHYSICALDRIVE027_2_00379D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00339D90 CreateFileA on filename \\.\PHYSICALDRIVE028_2_00339D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00379D90 CreateFileA on filename \\.\PHYSICALDRIVE029_2_00379D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_00299D90 CreateFileA on filename \\.\PHYSICALDRIVE030_2_00299D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00609D90 CreateFileA on filename \\.\PHYSICALDRIVE031_2_00609D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_00099D90 CreateFileA on filename \\.\PHYSICALDRIVE032_2_00099D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A9D90 CreateFileA on filename \\.\PHYSICALDRIVE033_2_002A9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00549D90 CreateFileA on filename \\.\PHYSICALDRIVE034_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00279D90 CreateFileA on filename \\.\PHYSICALDRIVE035_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A9D90 CreateFileA on filename \\.\PHYSICALDRIVE036_2_001A9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00149D90 CreateFileA on filename \\.\PHYSICALDRIVE037_2_00149D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00229D90 CreateFileA on filename \\.\PHYSICALDRIVE038_2_00229D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_00189D90 CreateFileA on filename \\.\PHYSICALDRIVE039_2_00189D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_00349D90 CreateFileA on filename \\.\PHYSICALDRIVE040_2_00349D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B9D90 CreateFileA on filename \\.\PHYSICALDRIVE041_2_008B9D90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Start Page Redirect CacheJump to behavior

            System Summary

            barindex
            Yara detected Darkbot
            Source: Yara matchFile source: Process Memory Space: Hwacaj.exe PID: 3532, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Hwacaj.exe PID: 3556, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: iexplore.exe PID: 3732, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: WmiPrvSE.exe PID: 2004, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1272, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 652, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1696, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 628, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1376, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1784, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 436, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1628, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1808, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 848, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2880, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2872, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2836, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2712, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2736, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2892, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 3036, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2052, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2664, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1076, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1448, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2468, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1372, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2344, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1212, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1468, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2184, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2188, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2908, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2920, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2244, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 2180, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: LMrDJmjGiVuMmdtVXtMTEmE.exe PID: 1440, type: MEMORYSTR
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_00401170 ShowCaret,ShowCaret,ShowCaret,NtUnmapViewOfSection,ShowCaret,VirtualAllocEx,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,Wow64SetThreadContext,ShowCaret,ResumeThread,0_2_00401170
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_004056E0 NtQuerySystemInformation,NtQuerySystemInformation,2_2_004056E0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00404D00 GetVersionExA,strncpy,NtQueryInformationProcess,2_2_00404D00
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00403440 printf,printf,printf,NtAllocateVirtualMemory,2_2_00403440
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00405C50 NtQueryInformationProcess,2_2_00405C50
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00405820 memset,NtGetNextProcess,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,InterlockedCompareExchange,WideCharToMultiByte,Sleep,CloseHandle,2_2_00405820
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_004053D0 NtQueryInformationThread,OpenProcess,NtQueryInformationProcess,InterlockedCompareExchange,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,CloseHandle,2_2_004053D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E253D0 NtQueryInformationThread,OpenProcess,NtQueryInformationProcess,InterlockedCompareExchange,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,CloseHandle,NtResumeThread,7_2_05E253D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E24D00 GetVersionExA,strncpy,NtQueryInformationProcess,7_2_05E24D00
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E26640 NtQueryDirectoryFile,wcsstr,wcsstr,wcsstr,7_2_05E26640
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E25C50 NtQueryInformationProcess,7_2_05E25C50
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E256E0 NtQuerySystemInformation,NtQuerySystemInformation,7_2_05E256E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E23440 printf,printf,printf,NtAllocateVirtualMemory,7_2_05E23440
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E25820 memset,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,InterlockedCompareExchange,WideCharToMultiByte,Sleep,CloseHandle,7_2_05E25820
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E26612 NtQueryDirectoryFile,wcsstr,wcsstr,7_2_05E26612
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040F2B0: sprintf,CreateFileA,memset,DeviceIoControl,CloseHandle,2_2_0040F2B0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00402D602_2_00402D60
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E22D607_2_05E22D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_00192D6010_2_00192D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_00392D6011_2_00392D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00102D6012_2_00102D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00252D6013_2_00252D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00102D6014_2_00102D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00542D6015_2_00542D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00142D6016_2_00142D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B2D6017_2_001B2D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00172D6018_2_00172D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00172D6019_2_00172D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00272D6020_2_00272D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00152D6021_2_00152D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00542D6022_2_00542D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00272D6023_2_00272D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00352D6024_2_00352D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00162D6025_2_00162D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00102D6026_2_00102D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00372D6027_2_00372D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00332D6028_2_00332D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00372D6029_2_00372D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_00292D6030_2_00292D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00602D6031_2_00602D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_00092D6032_2_00092D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A2D6033_2_002A2D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00542D6034_2_00542D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00272D6035_2_00272D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A2D6036_2_001A2D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00142D6037_2_00142D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00222D6038_2_00222D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_00182D6039_2_00182D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_00342D6040_2_00342D60
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B2D6041_2_008B2D60
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 05E2BA00 appears 37 times
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: String function: 0040BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0016BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0037B990 appears 48 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0054B990 appears 72 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0009BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0015BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0025BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0034BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 002ABA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0033BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0027BA00 appears 111 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0010B990 appears 72 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 001ABA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 008BBA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0027B990 appears 72 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0017B990 appears 48 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0035BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 001BBA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0022BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0037BA00 appears 74 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0037A310 appears 46 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0014B990 appears 48 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0054A310 appears 69 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0039BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0010BA00 appears 111 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0054BA00 appears 111 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0010A310 appears 69 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0060BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0027A310 appears 69 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0029BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0014BA00 appears 74 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0019BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0017A310 appears 46 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0018BA00 appears 37 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0017BA00 appears 74 times
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: String function: 0014A310 appears 46 times
            Source: Hwacaj.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: classification engineClassification label: mal100.troj.evad.winEXE@11/38@6/2
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00404C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,2_2_00404C20
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,2_2_0040A550
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E24C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,7_2_05E24C20
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E2A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,7_2_05E2A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_00194C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,10_2_00194C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_0019A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,10_2_0019A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_00394C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,11_2_00394C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_0039A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,11_2_0039A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00104C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,12_2_00104C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_0010A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,12_2_0010A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00254C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,13_2_00254C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_0025A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,13_2_0025A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00104C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,14_2_00104C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_0010A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,14_2_0010A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00544C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,15_2_00544C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_0054A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,15_2_0054A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00144C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,16_2_00144C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_0014A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,16_2_0014A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,17_2_001B4C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001BA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,17_2_001BA550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00174C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,18_2_00174C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_0017A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,18_2_0017A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00174C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,19_2_00174C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_0017A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,19_2_0017A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00274C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,20_2_00274C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_0027A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,20_2_0027A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00154C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,21_2_00154C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_0015A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,21_2_0015A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00544C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,22_2_00544C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_0054A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,22_2_0054A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00274C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,23_2_00274C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_0027A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,23_2_0027A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00354C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,24_2_00354C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_0035A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,24_2_0035A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00164C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,25_2_00164C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_0016A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,25_2_0016A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00104C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,26_2_00104C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_0010A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,26_2_0010A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00374C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,27_2_00374C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_0037A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,27_2_0037A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00334C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,28_2_00334C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_0033A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,28_2_0033A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00374C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,29_2_00374C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_0037A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,29_2_0037A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_00294C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,30_2_00294C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_0029A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,30_2_0029A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00604C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,31_2_00604C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_0060A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,31_2_0060A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_00094C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,32_2_00094C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_0009A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,32_2_0009A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,33_2_002A4C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002AA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,33_2_002AA550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00544C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,34_2_00544C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_0054A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,34_2_0054A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00274C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,35_2_00274C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_0027A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,35_2_0027A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,36_2_001A4C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001AA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,36_2_001AA550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00144C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,37_2_00144C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_0014A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,37_2_0014A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00224C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,38_2_00224C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_0022A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,38_2_0022A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_00184C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,39_2_00184C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_0018A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,39_2_0018A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_00344C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,40_2_00344C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_0034A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,40_2_0034A550
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,41_2_008B4C20
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008BA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,41_2_008BA550
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040EE40 CoCreateInstance,memset,lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFileInfoA,memset,lstrcpyA,lstrcatA,MultiByteToWideChar,2_2_0040EE40
            Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\History\LowJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMutant created: \Sessions\1\BaseNamedObjects\-d1ff3a37Mutex
            Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Temp\~DF09FCB74B2BED993F.TMPJump to behavior
            Source: Hwacaj.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Hwacaj.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Hwacaj.exeVirustotal: Detection: 88%
            Source: Hwacaj.exeReversingLabs: Detection: 100%
            Source: unknownProcess created: C:\Users\user\Desktop\Hwacaj.exe "C:\Users\user\Desktop\Hwacaj.exe"
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Windows\notepad.exe "C:\Windows\notepad.exe"
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Users\user\Desktop\Hwacaj.exe "C:\Users\user\Desktop\Hwacaj.exe"
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:275457 /prefetch:2
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Windows\notepad.exe "C:\Windows\notepad.exe" Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Users\user\Desktop\Hwacaj.exe "C:\Users\user\Desktop\Hwacaj.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE" Jump to behavior
            Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:275457 /prefetch:2Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\notepad.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\notepad.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeSection loaded: version.dll
            Source: C:\Users\user\Desktop\Hwacaj.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dllJump to behavior
            Source: Binary string: 86\ship\0\msohev.dll\bbtopt\msohevO.pdb source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmp
            Source: Binary string: t:\misc_hev\x86\ship\0\msohev.pdb86\ship\0\msohev.dll\bbtopt\msohevO.pdb source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmp
            Source: Binary string: t:\misc_urlredirection\x86\ship\0\urlredirection.pdb0\urlredirection.dll\bbtopt\urlredirectionO.pdb source: iexplore.exe, 00000007.00000002.628840238.0000000065C61000.00000020.00000001.01000000.0000000D.sdmp
            Source: Binary string: t:\misc_urlredirection\x86\ship\0\urlredirection.pdb source: iexplore.exe, 00000007.00000002.628840238.0000000065C61000.00000020.00000001.01000000.0000000D.sdmp
            Source: Binary string: t:\misc_hev\x86\ship\0\msohev.pdb source: iexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000000.358163038.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000B.00000000.358303491.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000C.00000000.358449372.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000D.00000002.619880696.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000E.00000000.358747147.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000F.00000002.620413068.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000010.00000002.619450317.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000011.00000002.620547861.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000012.00000000.360220245.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000013.00000000.360351050.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000014.00000002.619654570.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000015.00000000.360680304.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000016.00000000.360806713.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000017.00000002.619780142.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000018.00000002.620407592.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000019.00000002.620542679.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001A.00000000.362632168.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001B.00000000.362935110.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001C.00000000.363152176.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001D.00000000.363781936.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001E.00000002.619899409.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000001F.00000002.620536802.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000020.00000000.365121496.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000021.00000002.619873693.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 00000022.00000000.365499580.0000000000AAE000.00000002.00000001.01000000.00000005.sdmp, LMrDJmjGiVuMmd
            Source: Binary string: 0\urlredirection.dll\bbtopt\urlredirectionO.pdb source: iexplore.exe, 00000007.00000002.628840238.0000000065C61000.00000020.00000001.01000000.0000000D.sdmp

            Data Obfuscation

            barindex
            Detected unpacking (changes PE section rights)
            Source: C:\Users\user\Desktop\Hwacaj.exeUnpacked PE file: 2.2.Hwacaj.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
            Detected unpacking (creates a PE file in dynamic memory)
            Source: C:\Users\user\Desktop\Hwacaj.exeUnpacked PE file: 2.2.Hwacaj.exe.890000.1.unpack
            Detected unpacking (overwrites its own PE header)
            Source: C:\Users\user\Desktop\Hwacaj.exeUnpacked PE file: 2.2.Hwacaj.exe.400000.0.unpack
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_0040399B LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_0040399B
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_00404290 push eax; ret 0_2_004042BE
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00410F10 push eax; ret 2_2_00410F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_001A0F10 push eax; ret 10_2_001A0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_003A0F10 push eax; ret 11_2_003A0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_00110F10 push eax; ret 12_2_00110F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_00260F10 push eax; ret 13_2_00260F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_00110F10 push eax; ret 14_2_00110F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_00550F10 push eax; ret 15_2_00550F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_00150F10 push eax; ret 16_2_00150F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001C0F10 push eax; ret 17_2_001C0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_00180F10 push eax; ret 18_2_00180F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_00180F10 push eax; ret 19_2_00180F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_00280F10 push eax; ret 20_2_00280F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_00160F10 push eax; ret 21_2_00160F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_00550F10 push eax; ret 22_2_00550F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_00280F10 push eax; ret 23_2_00280F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_00360F10 push eax; ret 24_2_00360F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_00170F10 push eax; ret 25_2_00170F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_00110F10 push eax; ret 26_2_00110F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_00380F10 push eax; ret 27_2_00380F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_00340F10 push eax; ret 28_2_00340F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_00380F10 push eax; ret 29_2_00380F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_002A0F10 push eax; ret 30_2_002A0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_00610F10 push eax; ret 31_2_00610F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_000A0F10 push eax; ret 32_2_000A0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002B0F10 push eax; ret 33_2_002B0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_00550F10 push eax; ret 34_2_00550F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_00280F10 push eax; ret 35_2_00280F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001B0F10 push eax; ret 36_2_001B0F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_00150F10 push eax; ret 37_2_00150F3E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_00230F10 push eax; ret 38_2_00230F3E

            Persistence and Installation Behavior

            barindex
            Contains functionality to infect the boot sector
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE02_2_00409EC0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE02_2_00409D90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE07_2_05E29D90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE07_2_05E29EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE010_2_00199EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE010_2_00199D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE011_2_00399EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE011_2_00399D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE012_2_00109EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE012_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE013_2_00259EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE013_2_00259D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE014_2_00109EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE014_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE015_2_00549EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE015_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE016_2_00149EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE016_2_00149D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE017_2_001B9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE017_2_001B9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE018_2_00179EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE018_2_00179D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE019_2_00179EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE019_2_00179D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE020_2_00279EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE020_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE021_2_00159EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE021_2_00159D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE022_2_00549EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE022_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE023_2_00279EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE023_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE024_2_00359EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE024_2_00359D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE025_2_00169EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE025_2_00169D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE026_2_00109EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE026_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE027_2_00379EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE027_2_00379D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE028_2_00339EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE028_2_00339D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE029_2_00379EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE029_2_00379D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE030_2_00299EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE030_2_00299D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE031_2_00609EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE031_2_00609D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE032_2_00099EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE032_2_00099D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE033_2_002A9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE033_2_002A9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE034_2_00549EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE034_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE035_2_00279EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE035_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE036_2_001A9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE036_2_001A9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE037_2_00149EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE037_2_00149D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE038_2_00229EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE038_2_00229D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE039_2_00189EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE039_2_00189D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE040_2_00349EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE040_2_00349D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE041_2_008B9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE041_2_008B9D90

            Boot Survival

            barindex
            Contains functionality to infect the boot sector
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE02_2_00409EC0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE02_2_00409D90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE07_2_05E29D90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE07_2_05E29EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE010_2_00199EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE010_2_00199D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE011_2_00399EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE011_2_00399D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE012_2_00109EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE012_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE013_2_00259EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE013_2_00259D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE014_2_00109EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE014_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE015_2_00549EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE015_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE016_2_00149EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE016_2_00149D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE017_2_001B9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE017_2_001B9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE018_2_00179EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE018_2_00179D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE019_2_00179EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE019_2_00179D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE020_2_00279EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE020_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE021_2_00159EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE021_2_00159D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE022_2_00549EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE022_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE023_2_00279EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE023_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE024_2_00359EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE024_2_00359D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE025_2_00169EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE025_2_00169D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE026_2_00109EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE026_2_00109D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE027_2_00379EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE027_2_00379D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE028_2_00339EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE028_2_00339D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE029_2_00379EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE029_2_00379D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE030_2_00299EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE030_2_00299D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE031_2_00609EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE031_2_00609D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE032_2_00099EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE032_2_00099D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE033_2_002A9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE033_2_002A9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE034_2_00549EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE034_2_00549D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE035_2_00279EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE035_2_00279D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE036_2_001A9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE036_2_001A9D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE037_2_00149EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE037_2_00149D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE038_2_00229EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE038_2_00229D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE039_2_00189EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE039_2_00189D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE040_2_00349EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE040_2_00349D90
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE041_2_008B9EC0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE041_2_008B9D90

            Hooking and other Techniques for Hiding and Protection

            barindex
            Overwrites code with unconditional jumps - possibly settings hooks in foreign process
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 774CFA50 value: E9 3B 69 CC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 774CFDA8 value: E9 93 68 CC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 757158CD value: E9 2E B7 A7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 757182ED value: E9 AE 8D A7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 7576DF21 value: E9 EA 45 A2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 75709AE0 value: E9 8B 8A A8 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 756F5366 value: E9 55 BE A9 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 756F3EFC value: E9 8F D3 A9 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 6A08A9B0 value: E9 3B 6D 10 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 6A07572C value: E9 AF C0 11 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 769A6C19 value: E9 32 06 7F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 769A4889 value: E9 82 D4 7E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 76A91D20 value: E9 7B 03 70 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 76A0BF10 value: E9 4B 62 78 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 76A81610 value: E9 8B 0D 71 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 774D0078 value: E9 53 53 CC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1272 base: 774EEB2A value: E9 D1 67 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 774CFA50 value: E9 3B 69 EC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 774CFDA8 value: E9 93 68 EC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 757158CD value: E9 2E B7 C7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 757182ED value: E9 AE 8D C7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 7576DF21 value: E9 EA 45 C2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 75709AE0 value: E9 8B 8A C8 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 756F5366 value: E9 55 BE C9 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 756F3EFC value: E9 8F D3 C9 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 6A08A9B0 value: E9 3B 6D 30 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 6A07572C value: E9 AF C0 31 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 769A6C19 value: E9 32 06 9F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 769A4889 value: E9 82 D4 9E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 76A91D20 value: E9 7B 03 90 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 76A0BF10 value: E9 4B 62 98 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 76A81610 value: E9 8B 0D 91 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 774D0078 value: E9 53 53 EC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 652 base: 774EEB2A value: E9 D1 67 EA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 774CFA50 value: E9 3B 69 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 774CFDA8 value: E9 93 68 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 757158CD value: E9 2E B7 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 757182ED value: E9 AE 8D 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 7576DF21 value: E9 EA 45 99 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 75709AE0 value: E9 8B 8A 9F 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 756F5366 value: E9 55 BE A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 756F3EFC value: E9 8F D3 A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 6A08A9B0 value: E9 3B 6D 07 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 6A07572C value: E9 AF C0 08 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 769A6C19 value: E9 32 06 76 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 769A4889 value: E9 82 D4 75 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 76A91D20 value: E9 7B 03 67 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 76A0BF10 value: E9 4B 62 6F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 76A81610 value: E9 8B 0D 68 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 774D0078 value: E9 53 53 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1696 base: 774EEB2A value: E9 D1 67 C1 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 774CFA50 value: E9 3B 69 D8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 774CFDA8 value: E9 93 68 D8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 757158CD value: E9 2E B7 B3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 757182ED value: E9 AE 8D B3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 7576DF21 value: E9 EA 45 AE 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 75709AE0 value: E9 8B 8A B4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 756F5366 value: E9 55 BE B5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 756F3EFC value: E9 8F D3 B5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 6A08A9B0 value: E9 3B 6D 1C 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 6A07572C value: E9 AF C0 1D 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 769A6C19 value: E9 32 06 8B 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 769A4889 value: E9 82 D4 8A 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 76A91D20 value: E9 7B 03 7C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 76A0BF10 value: E9 4B 62 84 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 76A81610 value: E9 8B 0D 7D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 774D0078 value: E9 53 53 D8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 628 base: 774EEB2A value: E9 D1 67 D6 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 774CFA50 value: E9 3B 69 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 774CFDA8 value: E9 93 68 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 757158CD value: E9 2E B7 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 757182ED value: E9 AE 8D 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 7576DF21 value: E9 EA 45 99 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 75709AE0 value: E9 8B 8A 9F 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 756F5366 value: E9 55 BE A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 756F3EFC value: E9 8F D3 A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 6A08A9B0 value: E9 3B 6D 07 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 6A07572C value: E9 AF C0 08 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 769A6C19 value: E9 32 06 76 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 769A4889 value: E9 82 D4 75 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 76A91D20 value: E9 7B 03 67 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 76A0BF10 value: E9 4B 62 6F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 76A81610 value: E9 8B 0D 68 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 774D0078 value: E9 53 53 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1376 base: 774EEB2A value: E9 D1 67 C1 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 774CFA50 value: E9 3B 69 07 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 774CFDA8 value: E9 93 68 07 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 757158CD value: E9 2E B7 E2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 757182ED value: E9 AE 8D E2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 7576DF21 value: E9 EA 45 DD 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 75709AE0 value: E9 8B 8A E3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 756F5366 value: E9 55 BE E4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 756F3EFC value: E9 8F D3 E4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 6A08A9B0 value: E9 3B 6D 4B 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 6A07572C value: E9 AF C0 4C 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 769A6C19 value: E9 32 06 BA 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 769A4889 value: E9 82 D4 B9 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 76A91D20 value: E9 7B 03 AB 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 76A0BF10 value: E9 4B 62 B3 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 76A81610 value: E9 8B 0D AC 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 774D0078 value: E9 53 53 07 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1784 base: 774EEB2A value: E9 D1 67 05 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 774CFA50 value: E9 3B 69 C7 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 774CFDA8 value: E9 93 68 C7 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 757158CD value: E9 2E B7 A2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 757182ED value: E9 AE 8D A2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 7576DF21 value: E9 EA 45 9D 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 75709AE0 value: E9 8B 8A A3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 756F5366 value: E9 55 BE A4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 756F3EFC value: E9 8F D3 A4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 6A08A9B0 value: E9 3B 6D 0B 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 6A07572C value: E9 AF C0 0C 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 769A6C19 value: E9 32 06 7A 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 769A4889 value: E9 82 D4 79 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 76A91D20 value: E9 7B 03 6B 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 76A0BF10 value: E9 4B 62 73 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 76A81610 value: E9 8B 0D 6C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 774D0078 value: E9 53 53 C7 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 436 base: 774EEB2A value: E9 D1 67 C5 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 774CFA50 value: E9 3B 69 CE 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 774CFDA8 value: E9 93 68 CE 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 757158CD value: E9 2E B7 A9 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 757182ED value: E9 AE 8D A9 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 7576DF21 value: E9 EA 45 A4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 75709AE0 value: E9 8B 8A AA 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 756F5366 value: E9 55 BE AB 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 756F3EFC value: E9 8F D3 AB 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 6A08A9B0 value: E9 3B 6D 12 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 6A07572C value: E9 AF C0 13 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 769A6C19 value: E9 32 06 81 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 769A4889 value: E9 82 D4 80 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 76A91D20 value: E9 7B 03 72 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 76A0BF10 value: E9 4B 62 7A 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 76A81610 value: E9 8B 0D 73 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 774D0078 value: E9 53 53 CE 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1628 base: 774EEB2A value: E9 D1 67 CC 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 774CFA50 value: E9 3B 69 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 774CFDA8 value: E9 93 68 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 757158CD value: E9 2E B7 A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 757182ED value: E9 AE 8D A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 7576DF21 value: E9 EA 45 A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 75709AE0 value: E9 8B 8A A6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 756F5366 value: E9 55 BE A7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 756F3EFC value: E9 8F D3 A7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 6A08A9B0 value: E9 3B 6D 0E 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 6A07572C value: E9 AF C0 0F 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 769A6C19 value: E9 32 06 7D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 769A4889 value: E9 82 D4 7C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 76A91D20 value: E9 7B 03 6E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 76A0BF10 value: E9 4B 62 76 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 76A81610 value: E9 8B 0D 6F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 774D0078 value: E9 53 53 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1808 base: 774EEB2A value: E9 D1 67 C8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 774CFA50 value: E9 3B 69 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 774CFDA8 value: E9 93 68 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 757158CD value: E9 2E B7 A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 757182ED value: E9 AE 8D A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 7576DF21 value: E9 EA 45 A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 75709AE0 value: E9 8B 8A A6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 756F5366 value: E9 55 BE A7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 756F3EFC value: E9 8F D3 A7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 6A08A9B0 value: E9 3B 6D 0E 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 6A07572C value: E9 AF C0 0F 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 769A6C19 value: E9 32 06 7D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 769A4889 value: E9 82 D4 7C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 76A91D20 value: E9 7B 03 6E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 76A0BF10 value: E9 4B 62 76 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 76A81610 value: E9 8B 0D 6F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 774D0078 value: E9 53 53 CA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 848 base: 774EEB2A value: E9 D1 67 C8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 774CFA50 value: E9 3B 69 DA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 774CFDA8 value: E9 93 68 DA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 757158CD value: E9 2E B7 B5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 757182ED value: E9 AE 8D B5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 7576DF21 value: E9 EA 45 B0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 75709AE0 value: E9 8B 8A B6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 756F5366 value: E9 55 BE B7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 756F3EFC value: E9 8F D3 B7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 6A08A9B0 value: E9 3B 6D 1E 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 6A07572C value: E9 AF C0 1F 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 769A6C19 value: E9 32 06 8D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 769A4889 value: E9 82 D4 8C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 76A91D20 value: E9 7B 03 7E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 76A0BF10 value: E9 4B 62 86 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 76A81610 value: E9 8B 0D 7F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 774D0078 value: E9 53 53 DA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2880 base: 774EEB2A value: E9 D1 67 D8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 774CFA50 value: E9 3B 69 C8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 774CFDA8 value: E9 93 68 C8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 757158CD value: E9 2E B7 A3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 757182ED value: E9 AE 8D A3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 7576DF21 value: E9 EA 45 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 75709AE0 value: E9 8B 8A A4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 756F5366 value: E9 55 BE A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 756F3EFC value: E9 8F D3 A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 6A08A9B0 value: E9 3B 6D 0C 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 6A07572C value: E9 AF C0 0D 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 769A6C19 value: E9 32 06 7B 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 769A4889 value: E9 82 D4 7A 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 76A91D20 value: E9 7B 03 6C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 76A0BF10 value: E9 4B 62 74 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 76A81610 value: E9 8B 0D 6D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 774D0078 value: E9 53 53 C8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2872 base: 774EEB2A value: E9 D1 67 C6 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 774CFA50 value: E9 3B 69 07 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 774CFDA8 value: E9 93 68 07 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 757158CD value: E9 2E B7 E2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 757182ED value: E9 AE 8D E2 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 7576DF21 value: E9 EA 45 DD 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 75709AE0 value: E9 8B 8A E3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 756F5366 value: E9 55 BE E4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 756F3EFC value: E9 8F D3 E4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 6A08A9B0 value: E9 3B 6D 4B 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 6A07572C value: E9 AF C0 4C 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 769A6C19 value: E9 32 06 BA 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 769A4889 value: E9 82 D4 B9 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 76A91D20 value: E9 7B 03 AB 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 76A0BF10 value: E9 4B 62 B3 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 76A81610 value: E9 8B 0D AC 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 774D0078 value: E9 53 53 07 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2836 base: 774EEB2A value: E9 D1 67 05 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 774CFA50 value: E9 3B 69 DA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 774CFDA8 value: E9 93 68 DA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 757158CD value: E9 2E B7 B5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 757182ED value: E9 AE 8D B5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 7576DF21 value: E9 EA 45 B0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 75709AE0 value: E9 8B 8A B6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 756F5366 value: E9 55 BE B7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 756F3EFC value: E9 8F D3 B7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 6A08A9B0 value: E9 3B 6D 1E 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 6A07572C value: E9 AF C0 1F 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 769A6C19 value: E9 32 06 8D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 769A4889 value: E9 82 D4 8C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 76A91D20 value: E9 7B 03 7E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 76A0BF10 value: E9 4B 62 86 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 76A81610 value: E9 8B 0D 7F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 774D0078 value: E9 53 53 DA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2712 base: 774EEB2A value: E9 D1 67 D8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 774CFA50 value: E9 3B 69 E8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 774CFDA8 value: E9 93 68 E8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 757158CD value: E9 2E B7 C3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 757182ED value: E9 AE 8D C3 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 7576DF21 value: E9 EA 45 BE 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 75709AE0 value: E9 8B 8A C4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 756F5366 value: E9 55 BE C5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 756F3EFC value: E9 8F D3 C5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 6A08A9B0 value: E9 3B 6D 2C 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 6A07572C value: E9 AF C0 2D 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 769A6C19 value: E9 32 06 9B 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 769A4889 value: E9 82 D4 9A 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 76A91D20 value: E9 7B 03 8C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 76A0BF10 value: E9 4B 62 94 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 76A81610 value: E9 8B 0D 8D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 774D0078 value: E9 53 53 E8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2736 base: 774EEB2A value: E9 D1 67 E6 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 774CFA50 value: E9 3B 69 C9 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 774CFDA8 value: E9 93 68 C9 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 757158CD value: E9 2E B7 A4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 757182ED value: E9 AE 8D A4 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 7576DF21 value: E9 EA 45 9F 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 75709AE0 value: E9 8B 8A A5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 756F5366 value: E9 55 BE A6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 756F3EFC value: E9 8F D3 A6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 6A08A9B0 value: E9 3B 6D 0D 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 6A07572C value: E9 AF C0 0E 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 769A6C19 value: E9 32 06 7C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 769A4889 value: E9 82 D4 7B 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 76A91D20 value: E9 7B 03 6D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 76A0BF10 value: E9 4B 62 75 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 76A81610 value: E9 8B 0D 6E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 774D0078 value: E9 53 53 C9 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2892 base: 774EEB2A value: E9 D1 67 C7 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 774CFA50 value: E9 3B 69 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 774CFDA8 value: E9 93 68 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 757158CD value: E9 2E B7 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 757182ED value: E9 AE 8D 9E 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 7576DF21 value: E9 EA 45 99 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 75709AE0 value: E9 8B 8A 9F 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 756F5366 value: E9 55 BE A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 756F3EFC value: E9 8F D3 A0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 6A08A9B0 value: E9 3B 6D 07 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 6A07572C value: E9 AF C0 08 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 769A6C19 value: E9 32 06 76 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 769A4889 value: E9 82 D4 75 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 76A91D20 value: E9 7B 03 67 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 76A0BF10 value: E9 4B 62 6F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 76A81610 value: E9 8B 0D 68 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 774D0078 value: E9 53 53 C3 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 3036 base: 774EEB2A value: E9 D1 67 C1 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 774CFA50 value: E9 3B 69 EA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 774CFDA8 value: E9 93 68 EA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 757158CD value: E9 2E B7 C5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 757182ED value: E9 AE 8D C5 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 7576DF21 value: E9 EA 45 C0 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 75709AE0 value: E9 8B 8A C6 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 756F5366 value: E9 55 BE C7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 756F3EFC value: E9 8F D3 C7 8A Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 6A08A9B0 value: E9 3B 6D 2E 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 6A07572C value: E9 AF C0 2F 96 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 769A6C19 value: E9 32 06 9D 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 769A4889 value: E9 82 D4 9C 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 76A91D20 value: E9 7B 03 8E 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 76A0BF10 value: E9 4B 62 96 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 76A81610 value: E9 8B 0D 8F 89 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 774D0078 value: E9 53 53 EA 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2052 base: 774EEB2A value: E9 D1 67 E8 88 Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 774CFA50 value: E9 3B 69 E6 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 774CFDA8 value: E9 93 68 E6 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 757158CD value: E9 2E B7 C1 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 757182ED value: E9 AE 8D C1 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 7576DF21 value: E9 EA 45 BC 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 75709AE0 value: E9 8B 8A C2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 756F5366 value: E9 55 BE C3 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 756F3EFC value: E9 8F D3 C3 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 6A08A9B0 value: E9 3B 6D 2A 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 6A07572C value: E9 AF C0 2B 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 769A6C19 value: E9 32 06 99 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 769A4889 value: E9 82 D4 98 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 76A91D20 value: E9 7B 03 8A 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 76A0BF10 value: E9 4B 62 92 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 76A81610 value: E9 8B 0D 8B 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 774D0078 value: E9 53 53 E6 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2664 base: 774EEB2A value: E9 D1 67 E4 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 774CFA50 value: E9 3B 69 EA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 774CFDA8 value: E9 93 68 EA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 757158CD value: E9 2E B7 C5 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 757182ED value: E9 AE 8D C5 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 7576DF21 value: E9 EA 45 C0 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 75709AE0 value: E9 8B 8A C6 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 756F5366 value: E9 55 BE C7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 756F3EFC value: E9 8F D3 C7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 6A08A9B0 value: E9 3B 6D 2E 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 6A07572C value: E9 AF C0 2F 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 769A6C19 value: E9 32 06 9D 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 769A4889 value: E9 82 D4 9C 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 76A91D20 value: E9 7B 03 8E 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 76A0BF10 value: E9 4B 62 96 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 76A81610 value: E9 8B 0D 8F 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 774D0078 value: E9 53 53 EA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1076 base: 774EEB2A value: E9 D1 67 E8 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 774CFA50 value: E9 3B 69 DC 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 774CFDA8 value: E9 93 68 DC 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 757158CD value: E9 2E B7 B7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 757182ED value: E9 AE 8D B7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 7576DF21 value: E9 EA 45 B2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 75709AE0 value: E9 8B 8A B8 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 756F5366 value: E9 55 BE B9 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 756F3EFC value: E9 8F D3 B9 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 6A08A9B0 value: E9 3B 6D 20 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 6A07572C value: E9 AF C0 21 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 769A6C19 value: E9 32 06 8F 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 769A4889 value: E9 82 D4 8E 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 76A91D20 value: E9 7B 03 80 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 76A0BF10 value: E9 4B 62 88 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 76A81610 value: E9 8B 0D 81 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 774D0078 value: E9 53 53 DC 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1448 base: 774EEB2A value: E9 D1 67 DA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 774CFA50 value: E9 3B 69 13 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 774CFDA8 value: E9 93 68 13 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 757158CD value: E9 2E B7 EE 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 757182ED value: E9 AE 8D EE 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 7576DF21 value: E9 EA 45 E9 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 75709AE0 value: E9 8B 8A EF 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 756F5366 value: E9 55 BE F0 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 756F3EFC value: E9 8F D3 F0 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 6A08A9B0 value: E9 3B 6D 57 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 6A07572C value: E9 AF C0 58 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 769A6C19 value: E9 32 06 C6 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 769A4889 value: E9 82 D4 C5 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 76A91D20 value: E9 7B 03 B7 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 76A0BF10 value: E9 4B 62 BF 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 76A81610 value: E9 8B 0D B8 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 774D0078 value: E9 53 53 13 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2468 base: 774EEB2A value: E9 D1 67 11 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 774CFA50 value: E9 3B 69 BC 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 774CFDA8 value: E9 93 68 BC 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 757158CD value: E9 2E B7 97 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 757182ED value: E9 AE 8D 97 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 7576DF21 value: E9 EA 45 92 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 75709AE0 value: E9 8B 8A 98 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 756F5366 value: E9 55 BE 99 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 756F3EFC value: E9 8F D3 99 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 6A08A9B0 value: E9 3B 6D 00 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 6A07572C value: E9 AF C0 01 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 769A6C19 value: E9 32 06 6F 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 769A4889 value: E9 82 D4 6E 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 76A91D20 value: E9 7B 03 60 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 76A0BF10 value: E9 4B 62 68 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 76A81610 value: E9 8B 0D 61 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 774D0078 value: E9 53 53 BC 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1372 base: 774EEB2A value: E9 D1 67 BA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 774CFA50 value: E9 3B 69 DD 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 774CFDA8 value: E9 93 68 DD 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 757158CD value: E9 2E B7 B8 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 757182ED value: E9 AE 8D B8 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 7576DF21 value: E9 EA 45 B3 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 75709AE0 value: E9 8B 8A B9 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 756F5366 value: E9 55 BE BA 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 756F3EFC value: E9 8F D3 BA 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 6A08A9B0 value: E9 3B 6D 21 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 6A07572C value: E9 AF C0 22 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 769A6C19 value: E9 32 06 90 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 769A4889 value: E9 82 D4 8F 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 76A91D20 value: E9 7B 03 81 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 76A0BF10 value: E9 4B 62 89 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 76A81610 value: E9 8B 0D 82 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 774D0078 value: E9 53 53 DD 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2344 base: 774EEB2A value: E9 D1 67 DB 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 774CFA50 value: E9 3B 69 07 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 774CFDA8 value: E9 93 68 07 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 757158CD value: E9 2E B7 E2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 757182ED value: E9 AE 8D E2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 7576DF21 value: E9 EA 45 DD 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 75709AE0 value: E9 8B 8A E3 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 756F5366 value: E9 55 BE E4 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 756F3EFC value: E9 8F D3 E4 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 6A08A9B0 value: E9 3B 6D 4B 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 6A07572C value: E9 AF C0 4C 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 769A6C19 value: E9 32 06 BA 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 769A4889 value: E9 82 D4 B9 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 76A91D20 value: E9 7B 03 AB 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 76A0BF10 value: E9 4B 62 B3 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 76A81610 value: E9 8B 0D AC 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 774D0078 value: E9 53 53 07 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1212 base: 774EEB2A value: E9 D1 67 05 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 774CFA50 value: E9 3B 69 DA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 774CFDA8 value: E9 93 68 DA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 757158CD value: E9 2E B7 B5 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 757182ED value: E9 AE 8D B5 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 7576DF21 value: E9 EA 45 B0 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 75709AE0 value: E9 8B 8A B6 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 756F5366 value: E9 55 BE B7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 756F3EFC value: E9 8F D3 B7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 6A08A9B0 value: E9 3B 6D 1E 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 6A07572C value: E9 AF C0 1F 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 769A6C19 value: E9 32 06 8D 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 769A4889 value: E9 82 D4 8C 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 76A91D20 value: E9 7B 03 7E 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 76A0BF10 value: E9 4B 62 86 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 76A81610 value: E9 8B 0D 7F 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 774D0078 value: E9 53 53 DA 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 1468 base: 774EEB2A value: E9 D1 67 D8 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 774CFA50 value: E9 3B 69 CD 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 774CFDA8 value: E9 93 68 CD 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 757158CD value: E9 2E B7 A8 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 757182ED value: E9 AE 8D A8 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 7576DF21 value: E9 EA 45 A3 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 75709AE0 value: E9 8B 8A A9 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 756F5366 value: E9 55 BE AA 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 756F3EFC value: E9 8F D3 AA 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 6A08A9B0 value: E9 3B 6D 11 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 6A07572C value: E9 AF C0 12 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 769A6C19 value: E9 32 06 80 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 769A4889 value: E9 82 D4 7F 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 76A91D20 value: E9 7B 03 71 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 76A0BF10 value: E9 4B 62 79 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 76A81610 value: E9 8B 0D 72 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 774D0078 value: E9 53 53 CD 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2184 base: 774EEB2A value: E9 D1 67 CB 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 774CFA50 value: E9 3B 69 C7 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 774CFDA8 value: E9 93 68 C7 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 757158CD value: E9 2E B7 A2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 757182ED value: E9 AE 8D A2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 7576DF21 value: E9 EA 45 9D 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 75709AE0 value: E9 8B 8A A3 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 756F5366 value: E9 55 BE A4 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 756F3EFC value: E9 8F D3 A4 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 6A08A9B0 value: E9 3B 6D 0B 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 6A07572C value: E9 AF C0 0C 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 769A6C19 value: E9 32 06 7A 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 769A4889 value: E9 82 D4 79 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 76A91D20 value: E9 7B 03 6B 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 76A0BF10 value: E9 4B 62 73 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 76A81610 value: E9 8B 0D 6C 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 774D0078 value: E9 53 53 C7 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2188 base: 774EEB2A value: E9 D1 67 C5 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 774CFA50 value: E9 3B 69 D5 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 774CFDA8 value: E9 93 68 D5 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 757158CD value: E9 2E B7 B0 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 757182ED value: E9 AE 8D B0 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 7576DF21 value: E9 EA 45 AB 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 75709AE0 value: E9 8B 8A B1 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 756F5366 value: E9 55 BE B2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 756F3EFC value: E9 8F D3 B2 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 6A08A9B0 value: E9 3B 6D 19 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 6A07572C value: E9 AF C0 1A 96
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 769A6C19 value: E9 32 06 88 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 769A4889 value: E9 82 D4 87 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 76A91D20 value: E9 7B 03 79 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 76A0BF10 value: E9 4B 62 81 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 76A81610 value: E9 8B 0D 7A 89
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 774D0078 value: E9 53 53 D5 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2908 base: 774EEB2A value: E9 D1 67 D3 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 774CFA50 value: E9 3B 69 CB 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 774CFDA8 value: E9 93 68 CB 88
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 757158CD value: E9 2E B7 A6 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 757182ED value: E9 AE 8D A6 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 7576DF21 value: E9 EA 45 A1 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 75709AE0 value: E9 8B 8A A7 8A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeMemory written: PID: 2920 base: 756F5366 value: E9 55 BE A8 8A
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Found evasive API chain (may stop execution after checking system information)
            Source: C:\Users\user\Desktop\Hwacaj.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,ExitProcessgraph_2-5445
            Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
            Source: C:\Users\user\Desktop\Hwacaj.exeEvasive API call chain: GetPEB, DecisionNodes, ExitProcessgraph_2-5335
            Source: C:\Users\user\Desktop\Hwacaj.exeAPI coverage: 6.2 %
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI coverage: 2.1 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeAPI coverage: 1.6 %
            Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe TID: 1924Thread sleep time: -180000s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,2_2_0040F130
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E2F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,7_2_05E2F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_0019F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,10_2_0019F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_0039F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,11_2_0039F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,12_2_0010F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_0025F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,13_2_0025F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,14_2_0010F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_0054F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,15_2_0054F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_0014F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,16_2_0014F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001BF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,17_2_001BF130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_0017F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,18_2_0017F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_0017F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,19_2_0017F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_0027F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,20_2_0027F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_0015F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,21_2_0015F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_0054F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,22_2_0054F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_0027F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,23_2_0027F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_0035F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,24_2_0035F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_0016F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,25_2_0016F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,26_2_0010F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_0037F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,27_2_0037F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_0033F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,28_2_0033F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_0037F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,29_2_0037F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_0029F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,30_2_0029F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_0060F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,31_2_0060F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,32_2_0009F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002AF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,33_2_002AF130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_0054F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,34_2_0054F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_0027F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,35_2_0027F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001AF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,36_2_001AF130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_0014F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,37_2_0014F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_0022F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,38_2_0022F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_0018F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,39_2_0018F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_0034F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,40_2_0034F130
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008BF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,41_2_008BF130
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040F9E0 memset,GetLogicalDriveStringsA,lstrcatA,lstrcatA,2_2_0040F9E0
            Source: iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VmcIy
            Source: C:\Users\user\Desktop\Hwacaj.exeAPI call chain: ExitProcess graph end nodegraph_0-1877
            Source: C:\Users\user\Desktop\Hwacaj.exeAPI call chain: ExitProcess graph end nodegraph_2-5136
            Source: C:\Users\user\Desktop\Hwacaj.exeAPI call chain: ExitProcess graph end nodegraph_2-5132
            Source: C:\Users\user\Desktop\Hwacaj.exeAPI call chain: ExitProcess graph end nodegraph_2-5127
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess information queried: ProcessInformationJump to behavior

            Anti Debugging

            barindex
            Found API chain indicative of debugger detection
            Source: C:\Users\user\Desktop\Hwacaj.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleepgraph_2-5459
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00405A20 LdrEnumerateLoadedModules,CloseHandle,CreateThread,CloseHandle,CreateThread,CloseHandle,2_2_00405A20
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_0040399B LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_0040399B
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_004015A0 movd mm0, dword ptr fs:[00000030h]0_2_004015A0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_004035B0 mov eax, dword ptr fs:[00000030h]2_2_004035B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E235B0 mov eax, dword ptr fs:[00000030h]7_2_05E235B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_001935B0 mov eax, dword ptr fs:[00000030h]10_2_001935B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_003935B0 mov eax, dword ptr fs:[00000030h]11_2_003935B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_001035B0 mov eax, dword ptr fs:[00000030h]12_2_001035B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_002535B0 mov eax, dword ptr fs:[00000030h]13_2_002535B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_001035B0 mov eax, dword ptr fs:[00000030h]14_2_001035B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_005435B0 mov eax, dword ptr fs:[00000030h]15_2_005435B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_001435B0 mov eax, dword ptr fs:[00000030h]16_2_001435B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B35B0 mov eax, dword ptr fs:[00000030h]17_2_001B35B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_001735B0 mov eax, dword ptr fs:[00000030h]18_2_001735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_001735B0 mov eax, dword ptr fs:[00000030h]19_2_001735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_002735B0 mov eax, dword ptr fs:[00000030h]20_2_002735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_001535B0 mov eax, dword ptr fs:[00000030h]21_2_001535B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_005435B0 mov eax, dword ptr fs:[00000030h]22_2_005435B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_002735B0 mov eax, dword ptr fs:[00000030h]23_2_002735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_003535B0 mov eax, dword ptr fs:[00000030h]24_2_003535B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_001635B0 mov eax, dword ptr fs:[00000030h]25_2_001635B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_001035B0 mov eax, dword ptr fs:[00000030h]26_2_001035B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_003735B0 mov eax, dword ptr fs:[00000030h]27_2_003735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_003335B0 mov eax, dword ptr fs:[00000030h]28_2_003335B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_003735B0 mov eax, dword ptr fs:[00000030h]29_2_003735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_002935B0 mov eax, dword ptr fs:[00000030h]30_2_002935B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_006035B0 mov eax, dword ptr fs:[00000030h]31_2_006035B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_000935B0 mov eax, dword ptr fs:[00000030h]32_2_000935B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A35B0 mov eax, dword ptr fs:[00000030h]33_2_002A35B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_005435B0 mov eax, dword ptr fs:[00000030h]34_2_005435B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_002735B0 mov eax, dword ptr fs:[00000030h]35_2_002735B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A35B0 mov eax, dword ptr fs:[00000030h]36_2_001A35B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_001435B0 mov eax, dword ptr fs:[00000030h]37_2_001435B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_002235B0 mov eax, dword ptr fs:[00000030h]38_2_002235B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_001835B0 mov eax, dword ptr fs:[00000030h]39_2_001835B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_003435B0 mov eax, dword ptr fs:[00000030h]40_2_003435B0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B35B0 mov eax, dword ptr fs:[00000030h]41_2_008B35B0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00403810 GetProcessHeap,RtlAllocateHeap,2_2_00403810
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeProcess token adjusted: Debug

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Allocates memory in foreign processes
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 250000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 160000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 360000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 330000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 600000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 340000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 790000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 200000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1E0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 890000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 840000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 300000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 240000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 500000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 870000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 3E0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 460000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 380000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 4E0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 940000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 450000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 3E30000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory allocated: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 5E20000 protect: page execute and read and writeJump to behavior
            Changes memory attributes in foreign processes to executable or writable
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 250000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 160000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 160000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 360000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 360000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 330000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 600000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 600000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 340000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 340000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 790000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 200000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8A0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1E0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 890000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 410000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 840000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 300000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 240000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 500000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 870000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 3E0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 460000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 380000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 4E0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 940000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: C0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2B0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1D0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 450000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 3E30000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 3E30000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory protected: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 5E20000 protect: page execute and read and writeJump to behavior
            Contains functionality to inject code into remote processes
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_00401170 ShowCaret,ShowCaret,ShowCaret,NtUnmapViewOfSection,ShowCaret,VirtualAllocEx,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,Wow64SetThreadContext,ShowCaret,ResumeThread,0_2_00401170
            Contains functionality to inject threads in other processes
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_004042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,2_2_004042E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 7_2_05E242E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,7_2_05E242E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 10_2_001942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,10_2_001942E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 11_2_003942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,11_2_003942E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 12_2_001042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,12_2_001042E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 13_2_002542E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,13_2_002542E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 14_2_001042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,14_2_001042E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 15_2_005442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,15_2_005442E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 16_2_001442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,16_2_001442E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 17_2_001B42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,17_2_001B42E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 18_2_001742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,18_2_001742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 19_2_001742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,19_2_001742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 20_2_002742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,20_2_002742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 21_2_001542E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,21_2_001542E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 22_2_005442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,22_2_005442E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 23_2_002742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,23_2_002742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 24_2_003542E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,24_2_003542E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 25_2_001642E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,25_2_001642E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 26_2_001042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,26_2_001042E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 27_2_003742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,27_2_003742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 28_2_003342E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,28_2_003342E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 29_2_003742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,29_2_003742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 30_2_002942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,30_2_002942E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 31_2_006042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,31_2_006042E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 32_2_000942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,32_2_000942E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 33_2_002A42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,33_2_002A42E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 34_2_005442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,34_2_005442E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 35_2_002742E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,35_2_002742E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 36_2_001A42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,36_2_001A42E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 37_2_001442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,37_2_001442E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 38_2_002242E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,38_2_002242E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 39_2_001842E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,39_2_001842E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 40_2_003442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,40_2_003442E0
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: 41_2_008B42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,41_2_008B42E0
            Creates a thread in another existing process (thread injection)
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe EIP: 1275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 195C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 395C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 255C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 545C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 145C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 1B5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 175C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 175C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 155C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 545C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 355C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 165C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 375C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 335C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 375C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 295C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 605C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 95C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 2A5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 545C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 1A5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 145C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 225C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 185C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 345C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 8B5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe EIP: 795C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 195C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 8B5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 375C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 205C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 225C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 185C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 145C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 2A5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 8A5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 185C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 1E5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 895C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 155C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 415C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 845C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 95C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 295C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 265C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 305C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: D5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 215C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 245C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 145C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 505C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 8B5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 875C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 3E5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 465C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 155C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 265C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 215C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 405C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 355C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 395C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 175C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 405C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 385C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 4E5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 285C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 195C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 265C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 945C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 95C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 1C5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 285C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 275C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 2B5C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 155C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 265C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 455C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 95C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 115C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: unknown EIP: 105C50Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeThread created: C:\Program Files (x86)\Internet Explorer\iexplore.exe EIP: 5E25C50Jump to behavior
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtQueryInformationProcess: Direct from: 0x774CFAFA
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtQuerySystemInformation: Direct from: 0x774D20DE
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtClose: Direct from: 0x774CFA02
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtSetTimer: Direct from: 0x774D021A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtOpenFile: Direct from: 0x774CFD86
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtSetInformationThread: Direct from: 0x774E9893
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtCreateMutant: Direct from: 0x774D07BE
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtOpenKeyEx: Direct from: 0x774CFA4A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtAllocateVirtualMemory: Direct from: 0x774CFAE2
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtResumeThread: Direct from: 0x774D008D
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtOpenKeyEx: Direct from: 0x774D103A
            Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeNtUnmapViewOfSection: Direct from: 0x774CFCA2Jump to behavior
            Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeNtDelayExecution: Direct from: 0x774CFDA1Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtSetInformationProcess: Direct from: 0x774CFB4A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtAdjustPrivilegesToken: Direct from: 0x774CFEE2
            Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeNtSetInformationThread: Direct from: 0x774CF9CEJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtCreateThreadEx: Direct from: 0x774D08C6
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtMapViewOfSection: Direct from: 0x774CFC72
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtDeviceIoControlFile: Direct from: 0x774CF931
            Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeNtRequestWaitReplyPort: Direct from: 0x753C6BCEJump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtQueryValueKey: Direct from: 0x774CFACA
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtTerminateThread: Direct from: 0x774D00A6
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtOpenSection: Direct from: 0x774CFDEA
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtProtectVirtualMemory: Direct from: 0x774D005A
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtSetInformationThread: Direct from: 0x774CFF12
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtWriteVirtualMemory: Direct from: 0x774CFE36
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtQueryAttributesFile: Direct from: 0x774CFE7E
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtReadVirtualMemory: Direct from: 0x774CFEB2
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtTerminateThread: Direct from: 0x774E98D5Jump to behavior
            Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeNtTerminateProcess: Direct from: 0x774CFCD2Jump to behavior
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeNtQuerySystemInformation: Direct from: 0x774CFDD2
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Users\user\Desktop\Hwacaj.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 250000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 160000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 330000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 600000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1A0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 340000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 790000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 200000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8A0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1E0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 890000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 410000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 840000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 300000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: D0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 240000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 500000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 870000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 3E0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 460000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 380000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 4E0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 940000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2B0000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 450000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 5E20000 value starts with: 4D5AJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 250000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 160000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 360000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 330000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 600000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 540000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1A0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 340000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 790000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 370000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 200000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2A0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8A0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 180000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1E0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 890000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 410000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 840000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 290000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 300000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: D0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 240000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 140000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 500000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 8B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 870000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 3E0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 460000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 210000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 350000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 390000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 170000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 380000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 220000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 4E0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 190000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 940000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1C0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 280000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 270000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: C0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 2B0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 150000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 1D0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 260000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 130000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 450000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 80000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 90000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 110000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: F0000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe base: 100000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 3E30000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 5E20000Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Windows\notepad.exe "C:\Windows\notepad.exe" Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Users\user\Desktop\Hwacaj.exe "C:\Users\user\Desktop\Hwacaj.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"Jump to behavior
            Source: iexplore.exe, 00000007.00000002.618742463.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.620412456.0000000000AD0000.00000002.00000001.00040000.00000000.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000000.358172133.0000000000AD0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: iexplore.exe, 00000007.00000002.618742463.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.620412456.0000000000AD0000.00000002.00000001.00040000.00000000.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000000.358172133.0000000000AD0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: iexplore.exe, 00000007.00000002.618742463.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000002.620412456.0000000000AD0000.00000002.00000001.00040000.00000000.sdmp, LMrDJmjGiVuMmdtVXtMTEmE.exe, 0000000A.00000000.358172133.0000000000AD0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: !Progman
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,2_2_0040B480
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,7_2_05E2B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,10_2_0019B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,11_2_0039B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,12_2_0010B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,13_2_0025B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,14_2_0010B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,15_2_0054B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,16_2_0014B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,17_2_001BB480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,18_2_0017B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,19_2_0017B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,20_2_0027B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,21_2_0015B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,22_2_0054B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,23_2_0027B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,24_2_0035B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,25_2_0016B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,26_2_0010B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,27_2_0037B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,28_2_0033B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,29_2_0037B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,30_2_0029B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,31_2_0060B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,32_2_0009B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,33_2_002AB480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,34_2_0054B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,35_2_0027B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,36_2_001AB480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,37_2_0014B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,38_2_0022B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,39_2_0018B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,40_2_0034B480
            Source: C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exeCode function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,41_2_008BB480
            Source: C:\Users\user\Desktop\Hwacaj.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_0040E880 memset,lstrlenA,_snprintf,CreateNamedPipeA,CreateNamedPipeA,CloseHandle,ConnectNamedPipe,GetLastError,CreateThread,CloseHandle,CreateNamedPipeA,2_2_0040E880
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 2_2_00401AD0 GetSystemTimeAsFileTime,2_2_00401AD0
            Source: C:\Users\user\Desktop\Hwacaj.exeCode function: 0_2_004017C6 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,0_2_004017C6
            Source: C:\Users\user\Desktop\Hwacaj.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure1
            Replication Through Removable Media            		21
            Native API            		1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		1
            Credential API Hooking            		1
            System Time Discovery            		Remote Services1
            Archive Collected Data            		3
            Ingress Tool Transfer            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Bootkit            		1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		LSASS Memory11
            Peripheral Device Discovery            		Remote Desktop Protocol1
            Browser Session Hijacking            		21
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            Access Token Manipulation            		2
            Obfuscated Files or Information            		Security Account Manager3
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Credential API Hooking            		2
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook713
            Process Injection            		3
            Software Packing            		NTDS124
            System Information Discovery            		Distributed Component Object ModelInput Capture3
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            DLL Side-Loading            		LSA Secrets111
            Security Software Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Masquerading            		Cached Domain Credentials11
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
            Virtualization/Sandbox Evasion            		DCSync2
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Access Token Manipulation            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt713
            Process Injection            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron2
            Bootkit            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1581649 Sample: Hwacaj.exe Startdate: 28/12/2024 Architecture: WINDOWS Score: 100 41 Antivirus / Scanner detection for submitted sample 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected Darkbot 2->45 47 5 other signatures 2->47 9 Hwacaj.exe 1 2->9         started        process3 signatures4 49 Detected unpacking (changes PE section rights) 9->49 51 Detected unpacking (creates a PE file in dynamic memory) 9->51 53 Detected unpacking (overwrites its own PE header) 9->53 55 8 other signatures 9->55 12 Hwacaj.exe 3 9->12         started        15 notepad.exe 9->15         started        process5 signatures6 57 Changes memory attributes in foreign processes to executable or writable 12->57 59 Writes to foreign memory regions 12->59 61 Allocates memory in foreign processes 12->61 63 2 other signatures 12->63 17 LMrDJmjGiVuMmdtVXtMTEmE.exe 12->17 injected 20 LMrDJmjGiVuMmdtVXtMTEmE.exe 12->20 injected 22 WmiPrvSE.exe 12->22 injected 24 32 other processes 12->24 process7 signatures8 37 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->37 39 Found direct / indirect Syscall (likely to bypass EDR) 17->39 26 iexplore.exe 9 44 24->26         started        process9 process10 28 iexplore.exe 49 26->28         started        dnsIp11 31 sb.scorecardresearch.com 18.161.69.8, 443, 49179, 49180 MIT-GATEWAYSUS United States 28->31 33 code.jquery.com 151.101.66.137, 443, 49181, 49182 FASTLYUS United States 28->33 35 4 other IPs or domains 28->35

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Hwacaj.exe88%VirustotalBrowse
            Hwacaj.exe100%ReversingLabsWin32.Worm.DorkBot
            Hwacaj.exe100%AviraTR/Pincav.L
            Hwacaj.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://events-sandbox.data.msn.cn/OneCollector/1.00%Avira URL Cloudsafe
            http://go.microsof0%Avira URL Cloudsafe
            https://events-sandbox.data.microsoftstart.cn/OneCollector/1.0https://browser.events.data.microsofts0%Avira URL Cloudsafe
            https://assets.msn.c0%Avira URL Cloudsafe
            https://www.msn.comin0%Avira URL Cloudsafe
            https://www.msn.comream0%Avira URL Cloudsafe
            https://www.msn.comreammt0%Avira URL Cloudsafe
            https://www.msn.com60%Avira URL Cloudsafe
            https://assets.msn.comhttps://assets.msn.cn0%Avira URL Cloudsafe
            http://.exe0%Avira URL Cloudsafe
            https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            code.jquery.com
            		151.101.66.137
            		truefalse
              		high
              sb.scorecardresearch.com
              		18.161.69.8
              		truefalse
                		high
                assets.msn.com
                		unknown
                		unknownfalse
                  		high
                  www.msn.com
                  		unknown
                  		unknownfalse
                    		high
                    c.msn.com
                    		unknown
                    		unknownfalse
                      		high
                      browser.events.data.msn.com
                      		unknown
                      		unknownfalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://sb.scorecardresearch.com/b2?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*nullfalse
                          		high
                          https://code.jquery.com/jquery-3.6.3.min.jsfalse
                            		high
                            https://sb.scorecardresearch.com/b?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*nullfalse
                              		high

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngKiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://www.msn.com/fr-fr/actualite/microsoftnews/qui-sommes-nous/ar-AA135Z7yhttps://www.msn.com/de-iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.msn.com/ocid=iehpiexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://c.msn.com/iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://sb.scorecardresearch.com/b2?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.iexplore.exe, 00000007.00000002.624817462.00000000051C8000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.0000000005200000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.msn.com/id-id/berita/nasional/tentang-kami/ar-BBca8ZEhttps://www.msn.com/it-it/notizie/miexplore.exe, 00000007.00000002.626883358.00000000066C0000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://assets.msn.comhttps://assets.msn.cniexplore.exe, 00000007.00000002.625943506.0000000005B35000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jsiexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drfalse
                                            		high
                                            https://www.msn.com/?ocid=iehpHJqeEiexplore.exe, 00000007.00000002.627422448.0000000006960000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://code.jquery.com/jquery-3.6.3.min.jsteiexplore.exe, 00000007.00000003.382630517.0000000004B71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jso.viexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://events-sandbox.data.microsoftstart.cn/OneCollector/1.0https://browser.events.data.microsoftsiexplore.exe, 00000007.00000002.626968485.000000000674A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://c.msn.com/viexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.pngiexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036AC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.diginotar.nl/cps/pkioverheid0iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://assets.msn.com/bundles/v1/homePage/lest/midlevel/microsoft.b109cceab5e009228460.jsiexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://code.jquery.com/jquery-3.6.3.min.jsmillis:iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://deff.nelreports.net/api/report?cat=msniexplore.exe, 00000007.00000002.624817462.000000000521A000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040DC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382630517.0000000004BE6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.0000000004194000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004ADA000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370598320.0000000004BAB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382576586.0000000005212000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382204227.0000000005271000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000052B0000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://sb.scorecardresearch.com/iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://code.jquery.com/jquery-3.6.3.min.jsn.iexplore.exe, 00000007.00000003.382630517.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://deff.nelreports.net/api/reportiexplore.exe, 00000007.00000003.370598320.0000000004BAB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://events-sandbox.data.msn.com/OneCollector/1.0https://browser.events.data.msn.cn/OneCollector/iexplore.exe, 00000007.00000002.627122752.00000000067AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://browser.events.data.msn.com/OneCollector/1.0iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.msn.com/?ocid=iehp.dllliexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsotypiexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://go.microsofiexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngiexplore.exe, 00000007.00000002.623584967.00000000040DC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626914244.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036AC000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.msn.com/?ocid=iehpsiexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://assets.msn.com/staticsb/statics//priexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.msn.comiexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382576586.0000000005212000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382204227.0000000005271000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AC1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.msn.com6iexplore.exe, 00000007.00000002.624211070.0000000004C64000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://www.msn.com/?ocid=iehpniexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jstaiexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.msn.com/?ocid=iehpB889AE3iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://assets.msn.ciexplore.exe, 00000007.00000002.623584967.000000000415D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://assets.msn.com/service/MSN/Feed/me?$top=32&DisableTypeSerialization=true&activityId=7FF05383iexplore.exe, 00000007.00000002.627629460.0000000006AA9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngYiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.msn.com/?ocid=iehp9d3diexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js.iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngXiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.msn.com/?ocid=iehpr=n(26iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.msn.com/favicon.ico;biexplore.exe, 00000007.00000002.624817462.0000000005200000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js3iexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsn(63iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://events-sandbox.data.msn.cn/OneCollector/1.0iexplore.exe, 00000007.00000003.392808912.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626036189.0000000005B83000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://www.msn.com/?ocid=iehpr=n(26Q#1iexplore.exe, 00000007.00000003.373761462.0000000004B17000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.msn.com/?ocid=iehpC:iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jshttps://asiexplore.exe, 00000007.00000002.623498708.0000000004005000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.msn.cominiexplore.exe, 00000007.00000003.382595539.0000000004AE1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png)iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.msn.com/?ocid=iehp#lang=en-us&adsReferer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp&deviiexplore.exe, 00000007.00000003.373761462.0000000004B0D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373926600.0000000004B05000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370598320.0000000004BAB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382535000.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382630517.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373988174.0000000004B0D000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://assets.msn.com/config/v1/&ocid=iehp&os=windows&lociexplore.exe, 00000007.00000003.382630517.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373761462.0000000004B61000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373844002.0000000004B62000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.msn.com/?ocid=iehp(iexplore.exe, 00000007.00000003.370649049.0000000004BA4000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://assets.msn.comiexplore.exe, 00000007.00000003.373971071.0000000004BA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.msn.com/iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036B9000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.msn.com/?ocid=iehploreriexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://www.msn.com/?ocid=iehp#iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://assets.msn.com/Piexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js18)iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://www.msn.com/favicon.icociexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsjsfiexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.msn.com/?ocid=iehp;iexplore.exe, 00000007.00000002.624817462.0000000005060000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://assets.msn.com/bundles/v1/homePage/latest/miiexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://www.msn.com/?ocid=iehpiexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.382576586.0000000005200000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.0000000000766000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370476989.00000000050D4000.00000004.00000001.00020000.00000000.sdmp, ~DF7DCABBC5A497C821.TMP.5.dr, {1D7CEBF6-C50C-11EF-8F38-ECF4BBB5915B}.dat.5.drfalse
                                                                                                                                                  		high
                                                                                                                                                  https://www.msn.com/?oiexplore.exe, 00000007.00000002.624817462.00000000050A5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://www.msn.com/?ocid=iehp.iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://www.msn.com/?ocid=iehp3.6.3.min.js693935/IE11NTP/desktop-shape.pngiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://www.msn.com/?ocid=iehp8A/fiexplore.exe, 00000007.00000002.622848077.00000000036B9000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://www.msn.com/R7iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsiexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drfalse
                                                                                                                                                              		high
                                                                                                                                                              http://crl.entrust.net/2048ca.crl0iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://www.msn.com/?ocid=iehpMSN3iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://browser.events.data.msn.com/iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004B6D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngyiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://www.msn.com/?ocid=iehpe.prototype.tryReformatGuidiexplore.exe, 00000007.00000002.626044722.0000000005B97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://c.msn.com/c.gifhttps://c.msn.cn/c.gifiexplore.exe, 00000007.00000003.392763745.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js=o(iexplore.exe, 00000007.00000002.624211070.0000000004A8D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://.exeiexplore.exe, 00000007.00000002.628936688.0000000065D81000.00000020.00000001.01000000.0000000E.sdmpfalse
                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://ocsp.entrust.net03iexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://www.msn.comreammtiexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://www.msn.comreamiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://www.msn.com/favicon.icoiexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.00000000050A5000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624211070.0000000004AE1000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.624817462.0000000005200000.00000004.00000001.00020000.00000000.sdmp, imagestore.dat.7.drfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngliexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://www.msn.com/?ocid=iehpTelemetryInitOptions.getbatchSendScrollLoadTimeEventriexplore.exe, 00000007.00000002.626936808.0000000006725000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://sb.scorecardresearch.com/bhttps://c.microsoftstart.com/c.gifiexplore.exe, 00000007.00000002.627122752.00000000067A0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://assets.msn.com/config/v1/Diexplore.exe, 00000007.00000002.624048217.000000000483B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://sb.scorecardresearch.com/yiexplore.exe, 00000007.00000002.623584967.00000000040C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://assets.msn.com/Kiexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://ent-api.msn.com/Miexplore.exe, 00000007.00000002.623930907.00000000045B1000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.pngiexplore.exe, 00000007.00000002.616736386.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626914244.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.622848077.00000000036AC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsiexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370476989.00000000050D4000.00000004.00000001.00020000.00000000.sdmp, 9W4OIK4M.htm.7.drfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://assets.msn.com/Biexplore.exe, 00000007.00000002.623584967.00000000040FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/iexplore.exe, 00000007.00000002.624048217.000000000483B000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.623498708.0000000003FF0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/Icon.pngiexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngiexplore.exe, 00000007.00000003.510125439.0000000007268000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.626914244.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.625603862.0000000005848000.00000004.00000001.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.628358334.0000000007268000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000007.00000002.616736386.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.524419038.0000000005848000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://www.msn.com/?ocid=iehp...iexplore.exe, 00000007.00000003.373964707.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000007.00000003.370631246.0000000000800000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          151.101.66.137
                                                                                                                                                                                                          		code.jquery.comUnited States
                                                                                                                                                                                                          		54113FASTLYUSfalse
                                                                                                                                                                                                          18.161.69.8
                                                                                                                                                                                                          		sb.scorecardresearch.comUnited States
                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                          Analysis ID:1581649
                                                                                                                                                                                                          Start date and time:2024-12-28 12:07:58 +01:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 9m 19s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                                                                                                                                                                          Number of analysed new started processes analysed:9
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:34
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                                          Sample name:Hwacaj.exe
                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                          Classification:mal100.troj.evad.winEXE@11/38@6/2
                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          • Number of executed functions: 54
                                                                                                                                                                                                          • Number of non-executed functions: 383
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .exe

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe
                                                                                                                                                                                                          • Excluded IPs from analysis (whitelisted): 23.195.61.164, 204.79.197.203, 13.107.5.80, 23.63.235.179, 23.63.235.226, 23.63.235.170, 23.63.235.163, 23.63.235.187, 23.63.235.144, 23.63.235.168, 23.63.235.161, 23.63.235.178, 23.63.235.211, 23.63.235.219, 23.63.235.216, 23.63.235.208, 23.63.235.209, 23.63.235.192, 23.63.235.227, 23.63.235.155, 23.63.235.224, 23.63.235.193, 2.16.158.186, 2.16.158.56, 2.16.158.32, 2.16.158.42, 2.16.158.43, 2.16.158.185, 2.16.158.34, 2.16.158.51, 2.16.158.27, 13.74.129.1, 13.89.179.10, 204.79.197.237, 13.107.21.237, 152.199.19.161
                                                                                                                                                                                                          • Excluded domains from analysis (whitelisted): www.bing.com, assets.msn.com.edgekey.net, c-msn-com-nsatc.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ie9comview.vo.msecnd.net, api.bing.com, a-0003.a-msedge.net, onedscolprdcus12.centralus.cloudapp.azure.com, www-msn-com.a-0003.a-msedge.net, www-www.bing.com.trafficmanager.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e-0001.e-msedge.net, go.microsoft.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, c.bing.com, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, global.asimov.events.data.trafficmanager.net, e28578.d.akamaiedge.net, api-bing-com.e-0001.e-msedge.net, cs9.wpc.v0cdn.net
                                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                          06:08:50API Interceptor70x Sleep call for process: Hwacaj.exe modified
                                                                                                                                                                                                          06:08:53API Interceptor8389x Sleep call for process: LMrDJmjGiVuMmdtVXtMTEmE.exe modified
                                                                                                                                                                                                          06:09:01API Interceptor222x Sleep call for process: WmiPrvSE.exe modified

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          151.101.66.137http://novo.oratoriomariano.com/novo/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • code.jquery.com/jquery-3.3.1.min.js
                                                                                                                                                                                                          http://facebooksecurity.blogspot.ch/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • code.jquery.com/jquery-1.7.min.js
                                                                                                                                                                                                          http://site9615380.92.webydo.com/?v=1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • code.jquery.com/jquery-1.7.2.min.js
                                                                                                                                                                                                          http://grandprairie-water-damage-restoration.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • code.jquery.com/jquery-3.3.1.min.js
                                                                                                                                                                                                          2023121142000021ki01kvjs.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • code.jquery.com/jquery-latest.min.js
                                                                                                                                                                                                          18.161.69.8file.exeGet hashmaliciousAmadey, Nymaim, Stealc, VidarBrowse

                                                                                                                                                                                                            Domains

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            sb.scorecardresearch.comJA7cOAGHym.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.161.69.117
                                                                                                                                                                                                            aD7D9fkpII.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.110
                                                                                                                                                                                                            installer.batGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.106
                                                                                                                                                                                                            skript.batGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.66
                                                                                                                                                                                                            din.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.66
                                                                                                                                                                                                            lem.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.57
                                                                                                                                                                                                            HVlonDQpuI.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.244.18.32
                                                                                                                                                                                                            PodcastsTries.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.161.69.30
                                                                                                                                                                                                            https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 3.160.188.18
                                                                                                                                                                                                            ChoForgot.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 3.160.188.50
                                                                                                                                                                                                            code.jquery.comhttp://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=hGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4uGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.130.137
                                                                                                                                                                                                            phish_alert_iocp_v1.4.48 - 2024-12-26T092852.527.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.2.137
                                                                                                                                                                                                            https://contractnerds.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.194.137
                                                                                                                                                                                                            http://booking.extranetguests.com/Get hashmaliciousCAPTCHA Scam ClickFixBrowse
                                                                                                                                                                                                            • 151.101.194.137
                                                                                                                                                                                                            https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.130.137
                                                                                                                                                                                                            https://yungbucksbbq.com/portbiz/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.2.137
                                                                                                                                                                                                            https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            Audio02837498.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.194.137
                                                                                                                                                                                                            https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.66.137

                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            MIT-GATEWAYSUShttps://haleborealis.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.165.220.57
                                                                                                                                                                                                            https://fin.hiringplatform.ca/processes/197662-tax-legislation-officer-ec-06-ec-07?locale=enGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.161.97.93
                                                                                                                                                                                                            db0fa4b8db0333367e9bda3ab68b8042.i686.elfGet hashmaliciousMirai, GafgytBrowse
                                                                                                                                                                                                            • 19.235.79.192
                                                                                                                                                                                                            installer.batGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.106
                                                                                                                                                                                                            skript.batGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.165.220.66
                                                                                                                                                                                                            lem.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            • 18.164.116.98
                                                                                                                                                                                                            xd.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                            • 18.113.234.176
                                                                                                                                                                                                            xd.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                            • 19.34.137.22
                                                                                                                                                                                                            xd.x86.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                            • 18.50.43.230
                                                                                                                                                                                                            xd.ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                            • 18.114.62.59
                                                                                                                                                                                                            FASTLYUSrpDOUhuBC5.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                            • 151.101.129.91
                                                                                                                                                                                                            rpDOUhuBC5.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                            • 151.101.1.91
                                                                                                                                                                                                            https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.1.229
                                                                                                                                                                                                            http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=hGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4uGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 151.101.194.137
                                                                                                                                                                                                            Electrum-bch-4.4.2-x86_64.AppImage.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 185.199.111.133
                                                                                                                                                                                                            w22319us3M.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                                                                                                                                                                                                            • 185.199.109.133
                                                                                                                                                                                                            OiMp3TH.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                            • 185.199.108.133
                                                                                                                                                                                                            https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.129.229
                                                                                                                                                                                                            grand-theft-auto-5-theme-1-installer_qb8W-j1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.2.133

                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            7dcce5b76c8b17472d024758970a406bArchivo-PxFkiLTWYG-23122024095010.htaGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            Pago.xlsGet hashmaliciousAveMaria, UACMeBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            NB PO-104105107108.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            PyrNUtAUkw.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            SLNA_Updated_Medical_Grant_Application(1).docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            CMR ART009.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            Cot90012ARCACONTAL.xlsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            Estado.de.cuenta.xlsGet hashmaliciousAveMaria, UACMeBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            SOA USD67,353.35.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8
                                                                                                                                                                                                            Euro confirmation Sp.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 151.101.66.137
                                                                                                                                                                                                            • 18.161.69.8

                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4286
                                                                                                                                                                                                            Entropy (8bit):3.8046022951415335
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                                                                                                                                            MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                                                                                                                                            SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                                                                                                                                            SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                                                                                                                                            SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MP98E46N\www.msn[1].xml

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):127
                                                                                                                                                                                                            Entropy (8bit):4.947632498233719
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:D9yRtFwsSxzqC+eAsOFETYHFk66YRO2Q9qTUCz/KbZLKb:JUF+FqCqdFF6YRO3dTbkb
                                                                                                                                                                                                            MD5:BCF015BF927683A781C2CAD67CD03C79
                                                                                                                                                                                                            SHA1:DDE2259D04131691279931698D8BA870C80382A0
                                                                                                                                                                                                            SHA-256:DF90FFD07270960B0B5680579A85E94178E1356AB9D71EC271E56B40665AEB4F
                                                                                                                                                                                                            SHA-512:48D3CB03BC57C7B44D002EA7FE251E458C16A388E638E501DDE40CC7A0D0BBCD3D37D2E950B83C26C3B2BB8529F515AC53CD20941011C174ACAF09FEBBD77BE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:<root><item name="pageVersions" value="{&quot;hp&quot;:&quot;20241220.296&quot;}" ltime="3863641232" htime="31152408" /></root>

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1D7CEBF4-C50C-11EF-8F38-ECF4BBB5915B}.dat

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                                            Entropy (8bit):2.054793138781803
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:rIOGo/Q94NUGW/h4NY4N8V4N1NlWf9VNlWfw:rIOGo4946GWJ4q4SV4i1wI
                                                                                                                                                                                                            MD5:F169759C72759B19D03E320AEFF44362
                                                                                                                                                                                                            SHA1:73DC8339ED29813864941B779ABA71058A18AE94
                                                                                                                                                                                                            SHA-256:EE37FFC29C42DEE6D33DFE6AB11B96151974935F5018C8F35B00D099427CF838
                                                                                                                                                                                                            SHA-512:011D0CE1D99CFE416BB4F97AF87E8887EF6C70F4D9222536E51EC9827C74A99A15BA70D9E6DBB5C806B580DA2AD585AD598C43C391884B8B3AA7313FA2CC2F69
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................0^L..Y................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.9.e.t.8.H.Q.z.F.7.x.G.P.O.O.z.0.u.7.W.R.W.w.=.=.........:.......................................

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1D7CEBF6-C50C-11EF-8F38-ECF4BBB5915B}.dat

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4096
                                                                                                                                                                                                            Entropy (8bit):1.9334134696198557
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12:rl0ZGFMrEgmfu66FOxrEgmfu6qTNlIcatQZH5y4plPNlIcatQ32H5y4plB:rwG1xG8NljZZy4zPNlj32Zy4zB
                                                                                                                                                                                                            MD5:F8FB5507BDDE751A998BAE17C7874B4B
                                                                                                                                                                                                            SHA1:92580B13817183884DDE0763BFC4366DEC26B3D5
                                                                                                                                                                                                            SHA-256:E7150250EB0264A278408520C990E8CA4E5516BFFEF3236D8E0DB04F86011134
                                                                                                                                                                                                            SHA-512:626E4318A5147F791F712693384A8EFF293810846FC0E866479B187333939ED3683F6C2033C4995E63714752F23AE1165FFCA69205755E5445BB5DA0FBE9E758
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................wS..Y................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                            Size (bytes):6006
                                                                                                                                                                                                            Entropy (8bit):6.354137966031858
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:/zS29dcBUXqQVObIg0ZFY2q7UYWIzFhJFYo6syPYmSTZYVVQQT/VfygNN:/zSAcBKjg0jYh7TWqFpzTTGjT/Vfym
                                                                                                                                                                                                            MD5:B101CC5150BBF545AD218F6EA15A677E
                                                                                                                                                                                                            SHA1:89025F151437F8F0003FD382D9B2647B365A1536
                                                                                                                                                                                                            SHA-256:E603F6ECFD714FC7631AE72174A2EB89BAB06F500672A5A5C045AF39AF807632
                                                                                                                                                                                                            SHA-512:411111506C7EA485893EDCCC48C6B4B9987937B65A626E90017206F9D9183C8795DD6E420B6A16539B75F54A793D92F89B0E6471D0B202E675B0C6066F9AA8D0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:........D.h.t.t.p.:././.s.t.a.t.i.c.-.g.l.o.b.a.l.-.s.-.m.s.n.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.h.p.-.n.e.u./.s.c./.2.b./.a.5.e.a.2.1...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... .............._......._....D.h.t.t.p.:././.s.t.a.t.i.c.-.g.l.o.b.a.l.-.s.-.m.s.n.-.c.o.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\favicon[1].ico

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4286
                                                                                                                                                                                                            Entropy (8bit):5.912342955561912
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:YY2q7UYWIzFhJFYo6syPYmSTZYVVQQT/VfygN6:YYh7TWqFpzTTGjT/VfyZ
                                                                                                                                                                                                            MD5:A73B8189E32D3A97AE2FBF1A57931D49
                                                                                                                                                                                                            SHA1:560A8EA628A89A82233BF4288166B54789242966
                                                                                                                                                                                                            SHA-256:855F6B5EEA22A22F5F4ABCCEEED4B8969EFB3A99443036EB5EB64F5F46C8FD8E
                                                                                                                                                                                                            SHA-512:2B016E28A7E63DE8FCAD90DDB38CCD5D875A22CF53D723E055B7C7C9B7589CB818883234C6682CA25112AF3CB4BA61A1AED384C1638C04905FC6FAFDD37F79A4
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:...... .... .........(... ...@..... .................................G..."...?..<2...)...'...-...8..uD...@...8...............2...2...1...1...2...4...7...6.......................................T...Q...S..*J...@...9...7...:...B...K...U.|/G...[.r.....C...=...?..c@...D...E...D...D..{]...H...................................i.a.:...].p.U.{.N...H...F...H...L...S.~.\.q.f.c4`.h...g.R...O...P...S...V...V...U...S...S.. T...................................m.V.o.R.i.^.a.j.Z.u.T.}.R...S...V.z.\.q.e.e.l.V.i.E j.H.Y...Y...Z...Z...Z...Z...Z...Y...Y..KY...................................g.E.e.A.j.K.k.X.f.c.`.k.^.o.^.n.a.j.f.c.l.X.h.H.[.5.E...U...[...[...[...Z...Z...Z...Z...Z..cZ...................................Z.5.N.(.[.6.d.B.k.P.k.X.j.].j.].k.Z.m.S.h.H.\.7.M.$.@..SK.8.]...Z...[...[...[...[...[...[..d[...................................M.&.L.#.L.#YR.*.].7.d.B.h.H.j.I.h.G.c.?.Z.4.N.%.?...=...}h....}.yb.\y..Z...[...[...[...[..Q[.......................................A...@...B...I...Q.(.V./.X.1.V.0.Q.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\9W4OIK4M.htm

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:HTML document, ASCII text, with very long lines (58337), with CRLF line terminators
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):193376
                                                                                                                                                                                                            Entropy (8bit):5.451009323490069
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3072:4Zp+fyd5FO93Qiq6I8khsNyh/P9OZ8TixYE:C+fyA93Qx6I8hNyhX91OxYE
                                                                                                                                                                                                            MD5:28B88E6B1DD3D89BD04E68BBCC199E6C
                                                                                                                                                                                                            SHA1:78D4AACE6A2773265049A5A074E413FA4F739EF9
                                                                                                                                                                                                            SHA-256:292BCCBCA5A05F0A5476C16003D4B1D9F701A7418B0FCBD31FC1C38A087818FD
                                                                                                                                                                                                            SHA-512:C080E8BE89004C114B9D3F0A17A8000B416D10C522EC1705E895DEC136CD01A881BCEC371328388B1663BE6195CD793A3524AAA14D70A32306F43E0B8437CB2F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-eshbtntrtfac,prg-ehpsbhv,pnpwxexpire180,prg-cg-crosaloc1,routesportsprod,prg-adspeek,prg-pr2-widget-tab,1s-fcrypt,prg-cookiesync,prg-ctr-pnpc,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_c,prg-pr2-pred-dyf,prg-pr1-uc-no-store-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-promad,prg-1unified-no-store,cptest-msn-muid-t,1s-notifmapping,prg-sh-frnr,prg-wx-dhgrd,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-ct,prg-1s-workid,prg-1s-otelcf,prg-1sw-wxhail,prg-cg-notf-landing-t,prg-cg-notf-sub

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\common.802715d7a736bd82fc74[1].js

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):265561
                                                                                                                                                                                                            Entropy (8bit):5.432386621514022
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3072:Hw+voYPbYRFKstM4weHKyhqGF0/UnwQXXiR4U2JH5:HLvoMKkstM4wBVUnjJZ
                                                                                                                                                                                                            MD5:1C984AC84FC70C69942DF2AD7CD7933E
                                                                                                                                                                                                            SHA1:61A5C268E80AF49D161ADD6B6EE0DB6FC02EB6EA
                                                                                                                                                                                                            SHA-256:8D7E6CE8CC3594239246D481140C43546A2058B5B75DCA2048389C3713B9FE15
                                                                                                                                                                                                            SHA-512:1B19BC2DC7CDFD89A5657D0BDB9D9E63F6396994426780241E2F5F7669ECCFE4102814593A0E15170349F7340062D29AD8750B4B5DA43E63D624E3BA64F2FE98
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:"use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks||[]).push([["common"],{54085:function(e,t,n){var r;n.d(t,{p:function(){return r}}),function(e){e.Desktop="desktop",e.Phone="phone",e.Tablet="tablet"}(r||(r={}))},21290:function(e,t,n){n.d(t,{GB:function(){return s},Km:function(){return c},Oq:function(){return f},Sp:function(){return d},Wc:function(){return u},cm:function(){return p},e_:function(){return g},oH:function(){return h},r7:function(){return a},yL:function(){return l}});var r=n(45331),i=r.z.Alert,o={build:""};function a(e){Object.assign(o,e)}var s={id:22012,severity:i,pb:o},c={id:22014,severity:r.z.Critical,pb:o},u=(r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,{id:22027,severity:r.z.Critical,pb:o}),l=(r.z.Critical,r.z.Critical,{id:22031,severity:i,pb:o}),p={id:22032,severity:i,pb:o},d={id:22033,severity:i,pb:o},f={id:22034,severity:i,pb:o},h={id:22050,severity:i,pb:o},g={id:22051,severity:r.z.Deprecated,pb:o};r.z.De

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\experience.b374b0d5b40196862f17[1].js

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (62058), with no line terminators
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):231602
                                                                                                                                                                                                            Entropy (8bit):5.762554862752807
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:Bl4m9Uoyafb1Hjhw3dsrWnQHdiJg7hJ5BjNnaAyGJNyWVzskeUjlWSGu9bCxKYb1:Mm9r0g9KAvyWs7Gb9+Fb1Zzae
                                                                                                                                                                                                            MD5:3ACCB914F415F2E2C36775D5783CF112
                                                                                                                                                                                                            SHA1:7CB1F2677020EAFEAF7BFCCF2E15BC7DC45DC758
                                                                                                                                                                                                            SHA-256:D3722105B5C0D92A3E85ECA10174193CD0AF84DE74586B2EEE991182CFF5AFFE
                                                                                                                                                                                                            SHA-512:3024450B40BBF7F3482F465BC831E4826543DE5D6A634584AAE7C5EA4B72D8F6E75A675D9371BF92303E051BFF94ACE431A082D8BD5E89CB664FC0DEF41DB19B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:!function(){"use strict";var t,e,n,r={12451:function(t,e,n){var r=n(8460),i=n(2132),a=n(82589),o=n(9925),s=n(96838),c=n(56595),l=n(54616),d=n(82512),u=n(3290),f=n(8488),p=n(4577),m=n(4108),g=n(23159),h=n(65212),v=n(27310),b=n(54085),x=n(29714),y=n(3460),w=n(91898),k=n(42390),C=function(){function t(){}return Object.defineProperty(t,"viewType",{get:function(){return x.Gq.get(this.viewTypeKey)},set:function(t){x.Gq.set(this.viewTypeKey,t)},enumerable:!1,configurable:!0}),t.trackCallbacks=function(){switch((0,y.Bn)().currentColumnArrangement){case w.K$.c1:case w.K$.c2:t.viewType="size2column";break;case w.K$.c3:t.viewType="size3column";break;case w.K$.c4:t.viewType="size4column"}return t.viewType},t.getTelemetryProperties=function(t,e){var n=!("false"===k.c.getQueryParameterByName("enableTrack",e)),r=k.c.getQueryParameterByName("ocid",e)||"hpmsn",i=u.jG.ActivityIdLowerCaseNoHypens,a="0",o=!1;if(d.Al&&d.Al.ClientSettings){var s=d.Al.ClientSettings;"true"===s.static_page&&(o=!0),a=s.browser

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\favicon[1].ico

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4286
                                                                                                                                                                                                            Entropy (8bit):3.8046022951415335
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                                                                                                                                            MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                                                                                                                                            SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                                                                                                                                            SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                                                                                                                                            SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microsoft.b109cceab5e009228460[1].js

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text, with very long lines (65448)
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):94707
                                                                                                                                                                                                            Entropy (8bit):5.407635683386335
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:GSqLAEwLuZAFL1oL3SDk5v1VWkNWPEYydLLnnS+7ySGAEMbiYnRGwVKVt+RFVDh4:GJMCUCuW3WkNtnnDGgGwVKWklyGEQ
                                                                                                                                                                                                            MD5:AA2BEDDF57312EF1CD312880E2729EBA
                                                                                                                                                                                                            SHA1:8E53B59585F8C947924355AFDC72A62E27CD001C
                                                                                                                                                                                                            SHA-256:16933DCF75634F75F0A09A67FB0FF7D9D0556188A888CDD89E05F2D21997BB51
                                                                                                                                                                                                            SHA-512:64AC2CCE15619DA127C5F1B637BBB39C1EB3DB69DE30FB690863C7390EC0A6D0BA2BEE9B9BC20DFF2B4044D17CED483CE5294E624F792652E8E4E1AD6FFAD4DD
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:/*! For license information please see microsoft.b109cceab5e009228460.js.LICENSE.txt */."use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks||[]).push([["microsoft"],{39115:function(n,e,t){t.d(e,{Z:function(){return M}});var r=t(68897),i=t(44611),o=t(89734),u=t(98693),a=t(38629),c=t(64648),f=t(73966),s=t(64973),l=t(26105),d=t(46540),v=500,p="Channel has invalid priority - ";function g(n,e,t){e&&(0,f.kJ)(e)&&e[c.R5]>0&&(e=e.sort((function(n,e){return n[s.yi]-e[s.yi]})),(0,f.tO)(e,(function(n){n[s.yi]<v&&(0,f._y)(p+n[c.pZ])})),n[c.MW]({queue:(0,f.FL)(e),chain:(0,l.jV)(e,t[c.TC],t)}))}var h=t(27218),m=t(24200),y=t(92687),b=t(28055),S=function(n){function e(){var t,r,a=n.call(this)||this;function l(){t=0,r=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,l(),(0,i.Z)(e,a,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.MW](e),{remove:function(){(0,f.tO)(r,(function(n,t){if(n.id===e.id)return r[c.cb](t,1),-1}))}}},n[s.hL]=fu

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vendors.290823e0e7160e8e5303[1].js

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (44387), with NEL line terminators
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):194844
                                                                                                                                                                                                            Entropy (8bit):5.419132326845799
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3072:oSYgu0Mj/PJ3floxEsQtzbwDZ777/3DwLps0p:oSYguVJvSa5+Z7uOE
                                                                                                                                                                                                            MD5:1C8B7CFD513B7ECA52BA64947CEE70E4
                                                                                                                                                                                                            SHA1:6BA3FBE2E7514E981EB68E9A92E9EA7A499CCC0C
                                                                                                                                                                                                            SHA-256:D1730E14E7E3D2362E6C5FF0C9C36E08660F87317EC44551FAED419263240F2C
                                                                                                                                                                                                            SHA-512:1F6567D3870CFBE002CD447135020C9F1319DFAB76E3CEAFE4C62BDD79F78F2AB3E5958DE9E068A3937E1C469978FC2E4A56015B82E06FE1377A78B47D1B06DC
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:"use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks||[]).push([["vendors"],{29558:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},74322:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},25135:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t)&&null!==t)throw TypeError("Can't set "+String(t)+" as a prototype");return t}},6664:function(t,e,r){var n=r(23362),o=r(35093),i=r(79549),a=n("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},99027:function(t,e,r){var n=r(58306).charAt;t.exports=function(t,e,r){return e+(r?n(t,e).length:1)}},57699:function(t){t.exports=function(t,e,r){if(!(t instanceof e))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return t}},45150:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");return t}},60410:function(t){t.exports=

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\Icon[1].png

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):533
                                                                                                                                                                                                            Entropy (8bit):7.415663553371965
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
                                                                                                                                                                                                            MD5:B6162D100379E7F4EF709BA5C26D1BA8
                                                                                                                                                                                                            SHA1:AEA4244C56F00AA26064134863157A6EE9D7ABB9
                                                                                                                                                                                                            SHA-256:DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
                                                                                                                                                                                                            SHA-512:CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\desktop-shape[1].png

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                                            Entropy (8bit):5.986656121330302
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
                                                                                                                                                                                                            MD5:34760615AB0C180EB4B48739297FD0F2
                                                                                                                                                                                                            SHA1:789438D09CC27A08879B1A9686C82527270E7C24
                                                                                                                                                                                                            SHA-256:360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
                                                                                                                                                                                                            SHA-512:1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\jquery-3.6.3.min[1].js

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text, with very long lines (62499)
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):62588
                                                                                                                                                                                                            Entropy (8bit):5.297862074916597
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:ENjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkmU:EcqmCU3zhINzfmRU
                                                                                                                                                                                                            MD5:ECE3D2555E3F6F462739CB1A84638C0A
                                                                                                                                                                                                            SHA1:4422031FDFCD327A70647698A3D8A4CADE1F0FE3
                                                                                                                                                                                                            SHA-256:8B50A05AC7F72C113EB81EF89CD193F5BB0CC532C076013DD8D91CE21D99AB9C
                                                                                                                                                                                                            SHA-512:CC26A8A998DDD65919DEC9E4C06BB198F48EF0644AE5626FC1FC91239C49C38DD454E4874B012E0701B522C427ADA4F3852361037D7CED615722644F2C854E89
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:/*! jQuery v3.6.3 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ie-image[1].png

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):39155
                                                                                                                                                                                                            Entropy (8bit):7.8985187905985486
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
                                                                                                                                                                                                            MD5:E161E2045A32E4513E81954B1D83B953
                                                                                                                                                                                                            SHA1:0A06306203C286B8C342CFD856C1EE3F16728C7E
                                                                                                                                                                                                            SHA-256:7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
                                                                                                                                                                                                            SHA-512:7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\logo[1].png

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):27928
                                                                                                                                                                                                            Entropy (8bit):7.701164569435742
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
                                                                                                                                                                                                            MD5:862D29153222B9B15C3C73B61B930335
                                                                                                                                                                                                            SHA1:391BEBF4BA8910B718C5516491EB1C7D32D4C187
                                                                                                                                                                                                            SHA-256:3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
                                                                                                                                                                                                            SHA-512:6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f*.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....|%..I...x.]........I..m..a.?.vml76.O.:.lW........0|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ*....&..R4.F2........0-.r..n.|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mobile-image[1].png

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):23972
                                                                                                                                                                                                            Entropy (8bit):7.983082688064765
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
                                                                                                                                                                                                            MD5:64C4757048F068394817EE126FDBA8A6
                                                                                                                                                                                                            SHA1:3610DC2EB5E3C09809E94BD0694A06C7A51580FF
                                                                                                                                                                                                            SHA-256:A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
                                                                                                                                                                                                            SHA-512:373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF09FCB74B2BED993F.TMP

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                            Entropy (8bit):0.4554947949390437
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:+tQaKe/UFAlkxKZcvsUGlJ8mX19Xh9XRClccMZ//QZXC/:+tce8qfi0Nn8G37qq0S
                                                                                                                                                                                                            MD5:17DCE936B7148B7487EBECC634F24070
                                                                                                                                                                                                            SHA1:3F6E2B6527FDAB12B380CEC64CD9A6ACD6510F55
                                                                                                                                                                                                            SHA-256:7059E4C8F80CD32BCB1AAEEC8AE6A4734A2B53246CA1BFCB5B9464CF14DACBEC
                                                                                                                                                                                                            SHA-512:A538AF8F126D2663B641661E547DD24462E1CF0C312251CA2098DB2EE2EE6CF431ED5F261587C6E373F0A715B14A91D91EBD017B4287DFA024DC8674FC386C84
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF7DCABBC5A497C821.TMP

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                            Entropy (8bit):0.8143158987567958
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:13RsuXzMsoazlo0ZHqkAFnxFiuOaETA8Eyh:13RLaD
                                                                                                                                                                                                            MD5:67C4DB142C329931E6A0284AE8DC902A
                                                                                                                                                                                                            SHA1:798C85A81F8D656D8A0C1CA3A8D4E0145A745A5A
                                                                                                                                                                                                            SHA-256:15AC1F704F5DF4E344904C1AB7C8D18A997C2F4F136B020059EBEA0AE917E89A
                                                                                                                                                                                                            SHA-512:8E4A435CD427FDCF4C998C4AFCB7B6AEE3D88B768D18D12A5780CA2274011ED92B34FB4269CABCC5C386FEE680F97D46F259B06940BE44895DBA79A9576D4EF5
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\19SJOL46.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):224
                                                                                                                                                                                                            Entropy (8bit):4.368497538239295
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:r/h0VbjjTnUTqIH1EdIl8fK/TXOGG06zMXZ0c/TXOfjr:K8h14ZnGGkOlbr
                                                                                                                                                                                                            MD5:11ED8169422595F0186DF9661EAF1B6F
                                                                                                                                                                                                            SHA1:A522C4FB97253F1C3E06222D703FA3987AFC8FED
                                                                                                                                                                                                            SHA-256:4F24E9B60520A6D9C17A94D56657C9A568790AE4538EBFBE3675E67099682EF8
                                                                                                                                                                                                            SHA-512:C84B4DF88526202CAC7A62CCC66B6E8EB1E8FD5F81DC493AFBFE864A5318D43B49B0EA639BB29C111E5048B188F3C67D1517459E3121F0CD9251295F72E19854
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:USRLOC..msn.com/.9729.3565966336.31299259.3812164249.31152408.*.MUID.219D1F2007E16FB30A5D0A4306836E7D.msn.com/.1537.2149143552.31230863.3812632269.31152408.*._EDGE_V.1.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\1FLCBA5A.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):666
                                                                                                                                                                                                            Entropy (8bit):5.0916221310134
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12:ShQK2+cStivGXdBSmElbHUt2ZBnTVXvwMwDSRQKfRlTVaE+nYQHqRQdj2XU87TVV:jHmt5dBBgzUQbv3wDSWKfZ+n9KQ8U8vr
                                                                                                                                                                                                            MD5:8CC22ED5904A1BC23F28D63BD5B9B89C
                                                                                                                                                                                                            SHA1:EF506FE4F95C5275BCB1291986D691824D6049DF
                                                                                                                                                                                                            SHA-256:36F7A962336F36F227E1A5C26A754336A3359848F8109BD4B692B040CA93B545
                                                                                                                                                                                                            SHA-512:3C24D54694F8B73D22770A284D3FA7880D2E8D14E8266264923B147A5ED6AB0E4C0B915B9832B8A736CD62F59C7A92C89BE1F9598C23CBB5D8DE84C1B6C8F60E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:sptmarket.en-us||us|en-us|en-us|en||cf=8|RefA=00FF71492BEF416D9CA9E2910090666F.RefC=2024-12-28T11:08:56Z.www.msn.com/.1536.3565966336.31299259.3811540301.31152408.*.MUIDB.219D1F2007E16FB30A5D0A4306836E7D.www.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.MicrosoftApplicationsTelemetryDeviceId.1c4a008d-34f4-4758-b644-90a6fd6709d3.www.msn.com/.1601.1599675136.31225834.3869491438.31152408.*.ai_session.go5qcVius93o2EPOYFomDu|1735384142202|1735384142202.www.msn.com/.1601.393514752.31152413.3870265570.31152408.*.MSFPC.GUID=c4fa13c945fd41d1a2f78a4c51578c30&HASH=c4fa&LV=202412&V=4&LU=1735384145701.www.msn.com/.1601.1629675136.31225834.3903961415.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\3QD42NNO.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):224
                                                                                                                                                                                                            Entropy (8bit):4.373872723716103
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:r/h0VV3TqH1EdIl8fK/TXOGG06zMXZ0c/TXOfjr:Kbq14ZnGGkOlbr
                                                                                                                                                                                                            MD5:8A0B83C88376E8D049245DEAD241F925
                                                                                                                                                                                                            SHA1:D3F73E52DA91326B721C7AFDED7D187348E4321E
                                                                                                                                                                                                            SHA-256:518CA5AEE77A4536E2AEEE29B70FC7845D63B08B179C7659CD5A170C9960C60F
                                                                                                                                                                                                            SHA-512:E58ED6DD22F317A11F24C191B34533EEC021BA12BFCF6B772ECC7201D4B9159B4406562DB3E42B4DD4AAA1EBF3B2BB7F9F9B1A86764A96A4B48D90E5900AC4C0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:USRLOC..msn.com/.9729.3585966336.31299259.3833848197.31152408.*.MUID.219D1F2007E16FB30A5D0A4306836E7D.msn.com/.1537.2149143552.31230863.3812632269.31152408.*._EDGE_V.1.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\96M9MU40.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):521
                                                                                                                                                                                                            Entropy (8bit):5.049085695051131
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12:ShQK2+cStivGXdBSmElbHUt2ZBnTVXvwMwDSRQKfRlTVaE+nYQJ:jHmt5dBBgzUQbv3wDSWKfZ+n9J
                                                                                                                                                                                                            MD5:9899E7E9243D30F75EA86E5020EC7D82
                                                                                                                                                                                                            SHA1:A8E16AECB67FB8CFA01DC414BA19B07919F76495
                                                                                                                                                                                                            SHA-256:B1C67899547EA68C14296572631DF230C0CC2C491B2FE6EF2361FDA3540EC515
                                                                                                                                                                                                            SHA-512:76A42C6169B2F6F095073121FEC6455D3208AF3210BF0D0400D932CF90F798178EBE159BC3A15B57F13DE27902C336428CEFC46B1F222577852E9B2C3F3570B4
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:sptmarket.en-us||us|en-us|en-us|en||cf=8|RefA=00FF71492BEF416D9CA9E2910090666F.RefC=2024-12-28T11:08:56Z.www.msn.com/.1536.3565966336.31299259.3811540301.31152408.*.MUIDB.219D1F2007E16FB30A5D0A4306836E7D.www.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.MicrosoftApplicationsTelemetryDeviceId.1c4a008d-34f4-4758-b644-90a6fd6709d3.www.msn.com/.1601.1599675136.31225834.3869491438.31152408.*.ai_session.go5qcVius93o2EPOYFomDu|1735384142202|1735384142202.www.msn.com/.1601.393514752.31152413.3870265570.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\AQECQPGO.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):173
                                                                                                                                                                                                            Entropy (8bit):4.33075159321991
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:U8Ls2dXv7YhchGWdsNXdRc9v2XsBS8cW5Kg3L5dXv7Y6hTXcWOm9TSm9vn:FwWdsRNXWdRhTXOmxSo
                                                                                                                                                                                                            MD5:758023B9AE82C5A42565DFCFACBD9F61
                                                                                                                                                                                                            SHA1:A4FAA9C5B55E15D910D26051241D61A3B7C7510F
                                                                                                                                                                                                            SHA-256:4A8060487526631D5661CF2593BB9A30F6AE86F1ADF98B539A7BEBFF0F998CAD
                                                                                                                                                                                                            SHA-512:3ED2B92567BC30785A377237E1AB0AF47AA98642FAE8D0E95BA58CFBA06585BEF132D548364A57C430946399C7A3821EE6F8F7F845A0A63C41F3F8D61B65D13D
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MR.0.c.bing.com/.2147484673.309431168.31153817.3918312843.31152408.*.SRM_B.219D1F2007E16FB30A5D0A4306836E7D.c.bing.com/.2147484673.2259143552.31230863.3921276851.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\B17UQLCE.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):158
                                                                                                                                                                                                            Entropy (8bit):4.349882967031105
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:rEC6KfcSMOGjTvWUVhaUXUTqZz9vofv1v8cW5Kg5WOKfUQFyK/TXcWOGtz9vn:r/h0VbjjTnUTqIH1EdIl8fK/TXOGj
                                                                                                                                                                                                            MD5:FE53C3AE08E41319B3567770DE3FB526
                                                                                                                                                                                                            SHA1:63C9AED477EF89DD262BA5EA6114BD555B5D37A2
                                                                                                                                                                                                            SHA-256:E15FF9184B312B6472B9CD24A7B31A8AD06168D0B9198419860F7D0D2B1DEAAF
                                                                                                                                                                                                            SHA-512:7D6D27B43AE08DA1DD6EF5100AC5A14AB3583C4EAE6EAF5F7EB0CA7E6E02B4BEDE5771BF40D8E92CE83035D10F7315013F5898FDB2D772CC41C22BA0EE62D16A
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:USRLOC..msn.com/.9729.3565966336.31299259.3812164249.31152408.*.MUID.219D1F2007E16FB30A5D0A4306836E7D.msn.com/.1537.2149143552.31230863.3812632269.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\BKI4Z9RU.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):159
                                                                                                                                                                                                            Entropy (8bit):4.290622902581153
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:9DIS8cW5Kg3L6KfUVX6HTiF/TXcWOmXMUSv9j9vo9vGLfyKfUVX6cKXWdvSTSMU2:96dV8VX6HA/TXOm8b89UfZ8VX6JXWdKN
                                                                                                                                                                                                            MD5:9E5BDBC0EFB7689F921A67857E687CFD
                                                                                                                                                                                                            SHA1:FD3718CFCA2825EFBF1966031862E1C1658F1065
                                                                                                                                                                                                            SHA-256:359C1EEDAE62AEACB77A47534E3C1F64D3F233BA96EFFD132C61EADFDF14810C
                                                                                                                                                                                                            SHA-512:D3C412E00D4A7B663FB91BF70A189DF729502E008F3D65620B892532187457D6D2A2A10F4914D16BA22F9B010C62B1C1C49262531962BCD8C4263ECACB3487F5
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:SRM_M.219D1F2007E16FB30A5D0A4306836E7D.c.msn.com/.1025.2269143552.31230863.3927672917.31152408.*.MR.0.c.msn.com/.1025.319431168.31153817.3927672917.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\EOUXD433.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):165
                                                                                                                                                                                                            Entropy (8bit):4.922940416705076
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:rxAkknQewW+BW+tZBdyf8nmjcStfGN3fGELrLZfUQ2XccpTvWUVhaUUEVp9vn:ShQZ3M2mjcSti3fGc8XXtpjTvVj
                                                                                                                                                                                                            MD5:DC638B46F0D0D41DA356DA141C48129D
                                                                                                                                                                                                            SHA1:668AF8B1F3430419050E362C3132E90F90709928
                                                                                                                                                                                                            SHA-256:68D525E361F64D27E5833E9B7AAB6C078901DEB3E34EA89B1F66F1740A2AC222
                                                                                                                                                                                                            SHA-512:F4F78A1AF4085EFE4F4252810A71B90900B0210FBBE26F87C9DFFDDD192D9B24C0F96FFDC01C8CD7484D3A6CA1001CCDD21E00AC1D26B7BD0239E1B1E9A765EC
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:sptmarket.en-us||us|en-us|en-us|en||cf=8|RefA=00FF71492BEF416D9CA9E2910090666F.RefC=2024-12-28T11:08:56Z.www.msn.com/.1536.3565966336.31299259.3811540301.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\F96GDHE7.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):227
                                                                                                                                                                                                            Entropy (8bit):4.360067404893881
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:96dV8VX6HA/TXOm8b89UfZ8VX6JXWdKhbw+ytuvQZ8VX6ipFYbr:0i9Gxm8bRu9cGGb1ytuvb9FGbr
                                                                                                                                                                                                            MD5:57A1E3235BA4F85AEFAB2D3F54186AA0
                                                                                                                                                                                                            SHA1:3862CDFC0836BEB2A01671B23D09DDD9599C7D83
                                                                                                                                                                                                            SHA-256:F10C091910E2DC143FB89D83D0E0AE28AFE6A40C065ED9A7B04D09486EC0B6D9
                                                                                                                                                                                                            SHA-512:975FB90032548BF94D34841735F3E152F880876505022294965F72E98DAC9AD3887E81DFFD394449E94771C8B94682A36BCFF460266207D71DBE6EB7C4CAA50B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:SRM_M.219D1F2007E16FB30A5D0A4306836E7D.c.msn.com/.1025.2269143552.31230863.3927672917.31152408.*.MR.0.c.msn.com/.1025.319431168.31153817.3927672917.31152408.*.ANONCHK.0.c.msn.com/.1025.1338416640.31152410.3927672917.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\G0276ZMN.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):64
                                                                                                                                                                                                            Entropy (8bit):4.137898001139453
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:rEC6KfcSMOGjTvWUVhaUXUTqZz9vn:r/h0VbjjTnUTqH
                                                                                                                                                                                                            MD5:E84643A2CD948D841EB34A3CCF0A85C3
                                                                                                                                                                                                            SHA1:CDF61BFAD66451A56251FF3840E1D795EAC962E9
                                                                                                                                                                                                            SHA-256:E999629C5EAAFD60FA09AC9CA644DB317F8F27A2E0EDEEA956E1C24F69EC4631
                                                                                                                                                                                                            SHA-512:C401BB678ECDD07CA3A639CB6FF85E05F3EC396A3E22CA7C013B81830B955965BEA332FEED42BCAF776548CD21BD4BB68D0CAF57370AE9D22E3B5F369FBDE79E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:USRLOC..msn.com/.9729.3565966336.31299259.3812164249.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\GKGF4KC2.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):400
                                                                                                                                                                                                            Entropy (8bit):5.054570886144778
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:ShQZ3M2mjcSti3fGc8XXtpjTvVUPP+dX0c/TXOfj8eCPrXt2ZBsj8TV8oUM:ShQK2+cStivGXdBSmElbHUt2ZBnTVx
                                                                                                                                                                                                            MD5:F1FAA26C71C8CA623480E7B1C81014D3
                                                                                                                                                                                                            SHA1:53935C7103A108A9C86DF056D2DFBFE5BEE51CF2
                                                                                                                                                                                                            SHA-256:12F71EB68780A6498F294103676F015045D49C4C8005D0C76278C551DC89FEAF
                                                                                                                                                                                                            SHA-512:6A6B1D8E15C463107871086CE4373EAFC96E498D7629EB2EEBBE82EAFEFEAABE4DC09C8B4B83B0C13B026B8165B433183093B83EA781C2DCC8AE84465D1C2A3E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:sptmarket.en-us||us|en-us|en-us|en||cf=8|RefA=00FF71492BEF416D9CA9E2910090666F.RefC=2024-12-28T11:08:56Z.www.msn.com/.1536.3565966336.31299259.3811540301.31152408.*.MUIDB.219D1F2007E16FB30A5D0A4306836E7D.www.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.MicrosoftApplicationsTelemetryDeviceId.1c4a008d-34f4-4758-b644-90a6fd6709d3.www.msn.com/.1601.1599675136.31225834.3869491438.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\L7KLJXXP.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):224
                                                                                                                                                                                                            Entropy (8bit):4.389550629536086
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:r/h0VV3TqH1EdIl8VX6HA/TXOm8bu06zMXZ0c/TXOfjr:Kbq14Z9Gxm8bukOlbr
                                                                                                                                                                                                            MD5:691BAE338BAA40709EC934713D3D6211
                                                                                                                                                                                                            SHA1:3D53F6B0A19317D4168A0BAB8A42CFA4B98D3EC1
                                                                                                                                                                                                            SHA-256:6BAF5F916A1BE6D158FCD6F5F8FD04E10CAB357245C6493639C07BA7A1C8E04E
                                                                                                                                                                                                            SHA-512:B3A2D491E75D9D60D0A42B966FEDC887FEBB02C97E13C63678FA7829EA8635FEB0EF315E4B5D084277F078B0577297B8A96B4446005A2918E8138861B926D02F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:USRLOC..msn.com/.9729.3585966336.31299259.3833848197.31152408.*.MUID.219D1F2007E16FB30A5D0A4306836E7D.msn.com/.1025.2269143552.31230863.3927672917.31152408.*._EDGE_V.1.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\PJQS39CX.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):264
                                                                                                                                                                                                            Entropy (8bit):4.901356301841304
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:ShQZ3M2mjcSti3fGc8XXtpjTvVUPP+dX0c/TXOfjr:ShQK2+cStivGXdBSmElbr
                                                                                                                                                                                                            MD5:56E327B94DD536882CFAEC8664C6E2B1
                                                                                                                                                                                                            SHA1:50E3854688962D9E995650A7D4CAD77B8A5A82ED
                                                                                                                                                                                                            SHA-256:6D048968D924700ED3689F53BB25F58D94F77E28CAC7D65A8C3BDAD907001F90
                                                                                                                                                                                                            SHA-512:36454385D6C59E7C8FCDBA2FD48EC999FC780471A74CBFEF53C63B5C3272481159B066D2176BA8A633B7784C4D72040307B8DFB0AC281B447B05D6EC6F8D5D9B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:sptmarket.en-us||us|en-us|en-us|en||cf=8|RefA=00FF71492BEF416D9CA9E2910090666F.RefC=2024-12-28T11:08:56Z.www.msn.com/.1536.3565966336.31299259.3811540301.31152408.*.MUIDB.219D1F2007E16FB30A5D0A4306836E7D.www.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\R4PM9D8N.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):69
                                                                                                                                                                                                            Entropy (8bit):3.9989281743146976
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:U8Ls2dXv7YhchGWdsNXdRc9vn:FwWdsRq
                                                                                                                                                                                                            MD5:0833194284A4DF1E50B4858B26C2046A
                                                                                                                                                                                                            SHA1:214919692B136E314EF7323575454C6E5240D0AD
                                                                                                                                                                                                            SHA-256:693754A5813AD787582D851711B975806459B40F66BFA0518B37D6CFB1021730
                                                                                                                                                                                                            SHA-512:383AB529879C8604D81A36673EC41321EC68A9082C39648D6FCBE0DB451539F4861CF9E6F9182A8CB47BAD8EC12FB1EF85062E2A71536C81CD17AD455936E087
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MR.0.c.bing.com/.2147484673.309431168.31153817.3918312843.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\R7G5RW9T.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):97
                                                                                                                                                                                                            Entropy (8bit):4.354541971594272
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:9DIS8cW5Kg3L6KfUVX6HTiF/TXcWOmXMUSv9j9vn:96dV8VX6HA/TXOm8br
                                                                                                                                                                                                            MD5:4790D366DD6AF4B4095EABA16ACABCA1
                                                                                                                                                                                                            SHA1:67436CBBA9498BE361D55F256AAB9BDB119FB4DD
                                                                                                                                                                                                            SHA-256:C89FFF1E99AD5F26C919126FF99FA96A591E630B840F1807DF1F52A995141CFF
                                                                                                                                                                                                            SHA-512:F393B1B540F076D9C3814AE545C7ECC8D3C188BE7CB352FF9DE408727D2E0EA964668533F1456FC50332B72DA0832D0A639D866F8886550841166D307F053C8B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:SRM_M.219D1F2007E16FB30A5D0A4306836E7D.c.msn.com/.1025.2269143552.31230863.3927672917.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\U82JH1FB.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):101
                                                                                                                                                                                                            Entropy (8bit):4.318805386891202
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:eXv8cW5Kg2KCdXv7Y6hTXcWOlKVeTJXz9vn:MEd2Z7hTXOeeTH
                                                                                                                                                                                                            MD5:054A7920DDDFCF9B36A54C70F45C143A
                                                                                                                                                                                                            SHA1:7EACE52DCC7B0950610A716107C3DBF837BBDB87
                                                                                                                                                                                                            SHA-256:9759B446027F9657B3EFB3585F437299AF82B594DC0C88DB118ECAFDC40CC799
                                                                                                                                                                                                            SHA-512:1212E93257AF82125703D8486DB7DFAEA98D32591C2EAE8F6ADDF8A8C13DF8EAFF0B87D0178B6638AB633736EEE26D3730FF856BBA65609D1080AB522FB91465
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MUID.219D1F2007E16FB30A5D0A4306836E7D.bing.com/.2147484673.2259143552.31230863.3917220829.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\UNBHKXIM.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):224
                                                                                                                                                                                                            Entropy (8bit):4.368975900572781
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:r/h0VV3TqH1EdIl8VX6H7XsTXOaVG06zMXZ0c/TXOfjr:Kbq14Z9G1QGkOlbr
                                                                                                                                                                                                            MD5:C89CCE30AA62505E96A7BF5020629511
                                                                                                                                                                                                            SHA1:B65FE4A0D7C5AA75784BC44FDAF8EEF05FD017E5
                                                                                                                                                                                                            SHA-256:3FA5C21C1B933B8A5A805E77C8199439D8C9F2C54990263E61942B4FAB651FD9
                                                                                                                                                                                                            SHA-512:B636C962835766D049FA9491D683B57C1EA1E32A0C967F9864C66C67CE97FCEAF6ED99FF3B1B03E7BE2096A928426F9BB438B40AC321B5BEC8F2303109A5A569
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:USRLOC..msn.com/.9729.3585966336.31299259.3833848197.31152408.*.MUID.219D1F2007E16FB30A5D0A4306836E7D.msn.com/.1025.2229143552.31230863.3894289182.31152408.*._EDGE_V.1.msn.com/.9728.2149143552.31230863.3812944530.31152408.*.

                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\V9LE0PHP.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):277
                                                                                                                                                                                                            Entropy (8bit):4.372460970432237
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6:FwWdsRNXWdRhTXOmxSrXldRhTXOmdYTJJ:Fj2RNXmGm0rXfGmOH
                                                                                                                                                                                                            MD5:8F37E9B3754B396243A17EF8699A7B33
                                                                                                                                                                                                            SHA1:4797E854B0355C031621AE9D0D61E72079AEB177
                                                                                                                                                                                                            SHA-256:6F81CDCAB0B3417759D094FCE30899D0B363B18C71C5B9D3E411361A64A7B350
                                                                                                                                                                                                            SHA-512:5A7FBB457F9D66A24A6829EBB6A730280DFB6FFF70E09EA20E3814D1F4A18CBA0B0FFB69CBDD91C66057951D6997A351A29C6CE135F6656B9CC4E88B3CB134AC
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MR.0.c.bing.com/.2147484673.309431168.31153817.3918312843.31152408.*.SRM_B.219D1F2007E16FB30A5D0A4306836E7D.c.bing.com/.2147484673.2259143552.31230863.3921276851.31152408.*.SRM_M.219D1F2007E16FB30A5D0A4306836E7D.c.bing.com/.2147484673.2259143552.31230863.3923460992.31152408.*.

                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                            General

                                                                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                            Entropy (8bit):7.534791163824883
                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                            File name:Hwacaj.exe
                                                                                                                                                                                                            File size:126'976 bytes
                                                                                                                                                                                                            MD5:9f8aba858f3a742000b8d2cdf3e96aee
                                                                                                                                                                                                            SHA1:c2a1bc3f2358c62aa58e36e69347ff756214d495
                                                                                                                                                                                                            SHA256:0960360752ddc41534ac5635a616604e4778ade10b8d246c6a7a745c44285be1
                                                                                                                                                                                                            SHA512:6633f75e13f606db6b31fbdcfc713ec32d31e74bdf5fd2c395739d38e3a9b27af26f47fe16988347aa2c9a1d397eb9788fd01d00a7d1095b7efed60f797693f8
                                                                                                                                                                                                            SSDEEP:3072:1qgWbleYh9UT583F0tgyIhwLJZUPWfT1Zla7qKDg/XjkfF:YeYoeKgy3soJgDgrS
                                                                                                                                                                                                            TLSH:EAC3F11ABC4B4063F5A56670C2A287D1DFBF28537EE6906FDF1099891DE01CC5CA6371
                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@ ...s...s...s..%s...sc. s...sc.ss...s../s...s..$s...sX.(s...sRich...s................PE..L... .`P.................@.........

                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                            Icon Hash:aaf3e3e3918382a0

                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Entrypoint:0x4017c6
                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                            Digitally signed:false
                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                            DLL Characteristics:
                                                                                                                                                                                                            Time Stamp:0x5060AF20 [Mon Sep 24 19:06:08 2012 UTC]
                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                            OS Version Major:4
                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                            File Version Major:4
                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                            Subsystem Version Major:4
                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                            Import Hash:c3da1fb1ee82e4ae1507f30d0e2e82e4

                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                                            push FFFFFFFFh
                                                                                                                                                                                                            push 004050D8h
                                                                                                                                                                                                            push 00402400h
                                                                                                                                                                                                            mov eax, dword ptr fs:[00000000h]
                                                                                                                                                                                                            push eax
                                                                                                                                                                                                            mov dword ptr fs:[00000000h], esp
                                                                                                                                                                                                            sub esp, 58h
                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                            push esi
                                                                                                                                                                                                            push edi
                                                                                                                                                                                                            mov dword ptr [ebp-18h], esp
                                                                                                                                                                                                            call dword ptr [0040502Ch]
                                                                                                                                                                                                            xor edx, edx
                                                                                                                                                                                                            mov dl, ah
                                                                                                                                                                                                            mov dword ptr [00406950h], edx
                                                                                                                                                                                                            mov ecx, eax
                                                                                                                                                                                                            and ecx, 000000FFh
                                                                                                                                                                                                            mov dword ptr [0040694Ch], ecx
                                                                                                                                                                                                            shl ecx, 08h
                                                                                                                                                                                                            add ecx, edx
                                                                                                                                                                                                            mov dword ptr [00406948h], ecx
                                                                                                                                                                                                            shr eax, 10h
                                                                                                                                                                                                            mov dword ptr [00406944h], eax
                                                                                                                                                                                                            push 00000001h
                                                                                                                                                                                                            call 00007FE4E4900ACAh
                                                                                                                                                                                                            pop ecx
                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                            jne 00007FE4E490002Ah
                                                                                                                                                                                                            push 0000001Ch
                                                                                                                                                                                                            call 00007FE4E49000E8h
                                                                                                                                                                                                            pop ecx
                                                                                                                                                                                                            call 00007FE4E49009EAh
                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                            jne 00007FE4E490002Ah
                                                                                                                                                                                                            push 00000010h
                                                                                                                                                                                                            call 00007FE4E49000D7h
                                                                                                                                                                                                            pop ecx
                                                                                                                                                                                                            xor esi, esi
                                                                                                                                                                                                            mov dword ptr [ebp-04h], esi
                                                                                                                                                                                                            call 00007FE4E4900818h
                                                                                                                                                                                                            call dword ptr [00405028h]
                                                                                                                                                                                                            mov dword ptr [00406F38h], eax
                                                                                                                                                                                                            call 00007FE4E49006D6h
                                                                                                                                                                                                            mov dword ptr [00406934h], eax
                                                                                                                                                                                                            call 00007FE4E490047Fh
                                                                                                                                                                                                            call 00007FE4E49003C1h
                                                                                                                                                                                                            call 00007FE4E49000CCh
                                                                                                                                                                                                            mov dword ptr [ebp-30h], esi
                                                                                                                                                                                                            lea eax, dword ptr [ebp-5Ch]
                                                                                                                                                                                                            push eax
                                                                                                                                                                                                            call dword ptr [00405024h]
                                                                                                                                                                                                            call 00007FE4E4900352h
                                                                                                                                                                                                            mov dword ptr [ebp-64h], eax
                                                                                                                                                                                                            test byte ptr [ebp-30h], 00000001h
                                                                                                                                                                                                            je 00007FE4E4900028h
                                                                                                                                                                                                            movzx eax, word ptr [ebp+00h]

                                                                                                                                                                                                            Rich Headers

                                                                                                                                                                                                            Programming Language:
                                                                                                                                                                                                            • [C++] VS98 (6.0) build 8168
                                                                                                                                                                                                            • [ C ] VS98 (6.0) build 8168
                                                                                                                                                                                                            • [RES] VS98 (6.0) cvtres build 1720

                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x543c0x50.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x70000x17860.rsrc
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x50000xd4.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                            Sections

                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                            .text0x10000x32c60x40001172bab6dc1d945798d404a878aaf9bdFalse0.49249267578125data5.665950734760007IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .rdata0x50000x8e60x100017d51084d106e4ea4b23eef135c12424False0.269287109375data3.5215722941474525IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .data0x60000xf3c0x10003e1b1c92ce583ee157fc529916becc65False0.13134765625data1.2400208622302387IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                            .rsrc0x70000x178600x1800093b4146aee2caff6129cb0dd7f5ac7f5False0.981170654296875data7.988590201457782IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                            Resources

                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                            RT_ANICURSOR0x70600x17800dataEnglishUnited States1.0003740026595744

                                                                                                                                                                                                            Imports

                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                            KERNEL32.dllGetCurrentProcess, LoadLibraryA, lstrcatW, GetStringTypeA, LCMapStringW, LCMapStringA, MultiByteToWideChar, GetProcAddress, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, TerminateProcess, UnhandledExceptionFilter, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetCurrentThreadId, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, GetLastError, HeapDestroy, HeapCreate, VirtualFree, HeapFree, RtlUnwind, WriteFile, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, GetACP, GetOEMCP, HeapAlloc, VirtualAlloc, HeapReAlloc, GetStringTypeW
                                                                                                                                                                                                            USER32.dllEndTask, ShowCaret
                                                                                                                                                                                                            SHELL32.dllShellExecuteW, SHGetFolderPathW

                                                                                                                                                                                                            Possible Origin

                                                                                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                            EnglishUnited States

                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                            TCP Packets

                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594249964 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594260931 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594320059 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594355106 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594383955 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594435930 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594527960 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594542027 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594676018 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.594690084 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702311039 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702337980 CET44349181151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702387094 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702430964 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702480078 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702533007 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702754021 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702766895 CET44349181151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702794075 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.702822924 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.960690022 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.960761070 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.961889029 CET44349181151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.961945057 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.965640068 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.965651035 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.965948105 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.965991974 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.966392994 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.966403008 CET44349181151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.966691017 CET44349181151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.966733932 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.968873024 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.011332989 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.397495031 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.397561073 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398425102 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398478031 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398488998 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398529053 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398530006 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398542881 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398567915 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398580074 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398583889 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398591995 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398627043 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398632050 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398639917 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.398670912 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.409558058 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.409619093 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.409703016 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.409745932 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.417937994 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.417984009 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.418009043 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.418023109 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.418037891 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.418057919 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.426234961 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.426295996 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.426366091 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.426410913 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.427423954 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.427478075 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.432081938 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.432091951 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.432388067 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.432436943 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.435215950 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.439204931 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.439269066 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.444072962 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.444087029 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.444549084 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.444595098 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.475361109 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.517981052 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:04.518029928 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041599035 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041659117 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041697979 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041721106 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041722059 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041738033 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041752100 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041753054 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041779041 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041789055 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041800022 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041804075 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041829109 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041838884 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041850090 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041878939 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041898966 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041937113 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041944981 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041984081 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041989088 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.041996002 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042021036 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042032003 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042089939 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042417049 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042455912 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042468071 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042474985 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042489052 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.042507887 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.043279886 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.043324947 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047168970 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047203064 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047230005 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047239065 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047250986 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047285080 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047673941 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.047712088 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.055517912 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.055582047 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.055587053 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.055596113 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.055627108 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.063851118 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.063903093 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.063982964 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.064022064 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.072297096 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.072355032 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.072437048 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.072477102 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.080642939 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.080694914 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.088954926 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.089015961 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.089042902 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.089082003 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.161211014 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.161257029 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.161283016 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.161300898 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.161451101 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.161451101 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.165426016 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.165473938 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.165473938 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.165483952 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.165509939 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.165532112 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.173754930 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.173798084 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.173813105 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.173831940 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.173860073 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.173882961 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.182203054 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.182262897 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.190413952 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.190462112 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.190619946 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.190670013 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.198879004 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.198931932 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199065924 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199130058 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199141979 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199161053 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199198008 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199223995 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199253082 CET49182443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.199265003 CET44349182151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.537323952 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.537383080 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.537389994 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.537460089 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.538647890 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.538659096 CET4434917918.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.538670063 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.538702965 CET49179443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.539555073 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:05.587332964 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:06.152175903 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:06.152230024 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:06.152321100 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:06.152363062 CET4434918018.161.69.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:06.152405024 CET49180443192.168.2.2218.161.69.8
                                                                                                                                                                                                            Dec 28, 2024 12:10:52.134130001 CET49181443192.168.2.22151.101.66.137
                                                                                                                                                                                                            Dec 28, 2024 12:10:52.134254932 CET44349181151.101.66.137192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:10:52.134299994 CET49181443192.168.2.22151.101.66.137

                                                                                                                                                                                                            UDP Packets

                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                            Dec 28, 2024 12:08:54.455730915 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                                                            Dec 28, 2024 12:08:57.704477072 CET6551053192.168.2.228.8.8.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.431931019 CET6267253192.168.2.228.8.8.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.435507059 CET5647553192.168.2.228.8.8.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.463953018 CET4938453192.168.2.228.8.8.8
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.593859911 CET53564758.8.8.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.701855898 CET53493848.8.8.8192.168.2.22
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.892671108 CET5484253192.168.2.228.8.8.8

                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                            Dec 28, 2024 12:08:54.455730915 CET192.168.2.228.8.8.80xbf66Standard query (0)www.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:08:57.704477072 CET192.168.2.228.8.8.80x9484Standard query (0)assets.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.431931019 CET192.168.2.228.8.8.80xe1c2Standard query (0)c.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.435507059 CET192.168.2.228.8.8.80xfc17Standard query (0)sb.scorecardresearch.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.463953018 CET192.168.2.228.8.8.80x370Standard query (0)code.jquery.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.892671108 CET192.168.2.228.8.8.80xd678Standard query (0)browser.events.data.msn.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                            Dec 28, 2024 12:08:54.579216957 CET8.8.8.8192.168.2.220xbf66No error (0)www.msn.comwww-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:08:57.851517916 CET8.8.8.8192.168.2.220x9484No error (0)assets.msn.comassets.msn.com.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.576976061 CET8.8.8.8192.168.2.220xe1c2No error (0)c.msn.comc-msn-com-nsatc.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.593859911 CET8.8.8.8192.168.2.220xfc17No error (0)sb.scorecardresearch.com18.161.69.8A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.593859911 CET8.8.8.8192.168.2.220xfc17No error (0)sb.scorecardresearch.com18.161.69.30A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.593859911 CET8.8.8.8192.168.2.220xfc17No error (0)sb.scorecardresearch.com18.161.69.117A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.593859911 CET8.8.8.8192.168.2.220xfc17No error (0)sb.scorecardresearch.com18.161.69.125A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.701855898 CET8.8.8.8192.168.2.220x370No error (0)code.jquery.com151.101.66.137A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.701855898 CET8.8.8.8192.168.2.220x370No error (0)code.jquery.com151.101.194.137A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.701855898 CET8.8.8.8192.168.2.220x370No error (0)code.jquery.com151.101.130.137A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:02.701855898 CET8.8.8.8192.168.2.220x370No error (0)code.jquery.com151.101.2.137A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Dec 28, 2024 12:09:03.015104055 CET8.8.8.8192.168.2.220xd678No error (0)browser.events.data.msn.comglobal.asimov.events.data.trafficmanager.netCNAME (Canonical name)IN (0x0001)false

                                                                                                                                                                                                            HTTP Request Dependency Graph

                                                                                                                                                                                                            • https:
                                                                                                                                                                                                              • code.jquery.com
                                                                                                                                                                                                              • sb.scorecardresearch.com

                                                                                                                                                                                                            HTTPS Proxied Packets

                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            0192.168.2.2249182151.101.66.1374433732C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            2024-12-28 11:09:03 UTC314OUTGET /jquery-3.6.3.min.js HTTP/1.1
                                                                                                                                                                                                            Accept: application/javascript, */*;q=0.8
                                                                                                                                                                                                            Referer: https://www.msn.com/?ocid=iehp
                                                                                                                                                                                                            Accept-Language: en-US
                                                                                                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                            Accept-Encoding: gzip, deflate
                                                                                                                                                                                                            Host: code.jquery.com
                                                                                                                                                                                                            DNT: 1
                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC611INHTTP/1.1 200 OK
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Content-Length: 89947
                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                            Content-Type: application/javascript; charset=utf-8
                                                                                                                                                                                                            Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT
                                                                                                                                                                                                            ETag: "28feccc0-15f5b"
                                                                                                                                                                                                            Cache-Control: public, max-age=31536000, stale-while-revalidate=604800
                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                            Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                            Via: 1.1 varnish, 1.1 varnish
                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                            Age: 937615
                                                                                                                                                                                                            Date: Sat, 28 Dec 2024 11:09:04 GMT
                                                                                                                                                                                                            X-Served-By: cache-lga21985-LGA, cache-ewr-kewr1740021-EWR
                                                                                                                                                                                                            X-Cache: HIT, HIT
                                                                                                                                                                                                            X-Cache-Hits: 587, 0
                                                                                                                                                                                                            X-Timer: S1735384144.230660,VS0,VE1
                                                                                                                                                                                                            Vary: Accept-Encoding
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 33 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75
                                                                                                                                                                                                            Data Ascii: /*! jQuery v3.6.3 | (c) OpenJS Foundation and other contributors | jquery.org/license */!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 45 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 45 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 45 2e 6d 61 70 28 74 68 69 73 2c 66
                                                                                                                                                                                                            Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=E.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return E.each(this,e)},map:function(n){return this.pushStack(E.map(this,f
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 79 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f
                                                                                                                                                                                                            Data Ascii: on(e){var t,n;return!(!e||"[object Object]"!==o.call(e))&&(!(t=r(e))||"function"==typeof(n=y.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74
                                                                                                                                                                                                            Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",M="[\\x20\\t
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c
                                                                                                                                                                                                            Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t||(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10|55296,1023&n|56320))},re=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 76 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 45 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 69 66 28 64 2e 63 73 73 53 75 70 70 6f 72 74 73 53 65 6c 65 63 74 6f 72 26 26 21 43 53 53 2e 73 75 70 70 6f 72 74 73 28 22 73 65 6c 65 63 74 6f
                                                                                                                                                                                                            Data Ascii: )){(f=ee.test(t)&&ve(e.parentNode)||e)===e&&d.scope||((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=E)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{if(d.cssSupportsSelector&&!CSS.supports("selecto
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 22 69 6e 20 65 26 26 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 61 29 7b 72 65 74 75 72 6e 20 6c 65 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6f 3d 2b 6f 2c 6c 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e
                                                                                                                                                                                                            Data Ascii: "in e&&e.disabled===t}}function ye(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ve(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 3f 28 62 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 74 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 53 29 7b 76 61 72 20 6e 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 72 65 74 75 72 6e 20 6e 3f 5b 6e 5d 3a 5b 5d 7d 7d 29 3a 28 62 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65
                                                                                                                                                                                                            Data Ascii: ?(b.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return e.getAttribute("id")===t}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&S){var n=t.getElementById(e);return n?[n]:[]}}):(b.filter.ID=function(e){var n=e.replace
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 52 2b 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 45 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 7e 3d 22 29 2c 28 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 22 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22
                                                                                                                                                                                                            Data Ascii: [selected]").length||y.push("\\["+M+"*(?:value|"+R+")"),e.querySelectorAll("[id~="+E+"-]").length||y.push("~="),(t=C.createElement("input")).setAttribute("name",""),e.appendChild(t),e.querySelectorAll("[name='']").length||y.push("\\["+M+"*name"+M+"*="+M+"
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC1378INData Raw: 6e 74 45 6c 65 6d 65 6e 74 7c 7c 65 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 6a 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75
                                                                                                                                                                                                            Data Ascii: ntElement||e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},j=t?function(e,t){if(e===t)retu


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            1192.168.2.224917918.161.69.84433732C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            2024-12-28 11:09:04 UTC515OUTGET /b?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1
                                                                                                                                                                                                            Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
                                                                                                                                                                                                            Referer: https://www.msn.com/?ocid=iehp
                                                                                                                                                                                                            Accept-Language: en-US
                                                                                                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                            Accept-Encoding: gzip, deflate
                                                                                                                                                                                                            Host: sb.scorecardresearch.com
                                                                                                                                                                                                            DNT: 1
                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                            2024-12-28 11:09:05 UTC656INHTTP/1.1 302 Found
                                                                                                                                                                                                            Content-Length: 0
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Date: Sat, 28 Dec 2024 11:09:05 GMT
                                                                                                                                                                                                            Accept-CH: UA, Platform, Arch, Model, Mobile
                                                                                                                                                                                                            Location: /b2?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null
                                                                                                                                                                                                            set-cookie: UID=10C8079d7f0587ad2de98bf1735384145; domain=.scorecardresearch.com; path=/; max-age=33696000
                                                                                                                                                                                                            X-Cache: Miss from cloudfront
                                                                                                                                                                                                            Via: 1.1 58a9e12c12a1247c70686d547c90f2f2.cloudfront.net (CloudFront)
                                                                                                                                                                                                            X-Amz-Cf-Pop: DXB52-P1
                                                                                                                                                                                                            X-Amz-Cf-Id: m18A3yydDMhmaWdcYG_CIkbnoqjHhtpfxmcpURUjIBBSXlmYTUrj2w==


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            2192.168.2.224918018.161.69.84433732C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            2024-12-28 11:09:05 UTC516OUTGET /b2?rn=1735384141986&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=219D1F2007E16FB30A5D0A4306836E7D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1
                                                                                                                                                                                                            Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
                                                                                                                                                                                                            Referer: https://www.msn.com/?ocid=iehp
                                                                                                                                                                                                            Accept-Language: en-US
                                                                                                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                            Accept-Encoding: gzip, deflate
                                                                                                                                                                                                            Host: sb.scorecardresearch.com
                                                                                                                                                                                                            DNT: 1
                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                            2024-12-28 11:09:06 UTC326INHTTP/1.1 204 No Content
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Date: Sat, 28 Dec 2024 11:09:05 GMT
                                                                                                                                                                                                            Accept-CH: UA, Platform, Arch, Model, Mobile
                                                                                                                                                                                                            X-Cache: Miss from cloudfront
                                                                                                                                                                                                            Via: 1.1 80c8781a9f32fddb0d2b18fc51705b54.cloudfront.net (CloudFront)
                                                                                                                                                                                                            X-Amz-Cf-Pop: DXB52-P1
                                                                                                                                                                                                            X-Amz-Cf-Id: X7Iu-GjnfKYELk2pE4KkYUC72CIhC-ceuRy6wvBedigYEoOJVPXULw==


                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                            Start time:06:08:47
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Users\user\Desktop\Hwacaj.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\Hwacaj.exe"
                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                            File size:126'976 bytes
                                                                                                                                                                                                            MD5 hash:9F8ABA858F3A742000B8D2CDF3E96AEE
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:1
                                                                                                                                                                                                            Start time:06:08:48
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Windows\notepad.exe
                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                            Commandline:"C:\Windows\notepad.exe"
                                                                                                                                                                                                            Imagebase:0xfff90000
                                                                                                                                                                                                            File size:193'536 bytes
                                                                                                                                                                                                            MD5 hash:B32189BDFF6E577A92BAA61AD49264E6
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                            Start time:06:08:48
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Users\user\Desktop\Hwacaj.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\Hwacaj.exe"
                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                            File size:126'976 bytes
                                                                                                                                                                                                            MD5 hash:9F8ABA858F3A742000B8D2CDF3E96AEE
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:4
                                                                                                                                                                                                            Start time:06:08:50
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                            File size:815'304 bytes
                                                                                                                                                                                                            MD5 hash:8A590F790A98F3D77399BE457E01386A
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                                            Start time:06:08:50
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                            Commandline:"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
                                                                                                                                                                                                            Imagebase:0x13f6f0000
                                                                                                                                                                                                            File size:814'288 bytes
                                                                                                                                                                                                            MD5 hash:4EB098135821348270F27157F7A84E65
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                                            Start time:06:08:51
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:275457 /prefetch:2
                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                            File size:815'304 bytes
                                                                                                                                                                                                            MD5 hash:8A590F790A98F3D77399BE457E01386A
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                            Imagebase:0xb70000
                                                                                                                                                                                                            File size:355'328 bytes
                                                                                                                                                                                                            MD5 hash:54B7C43C2E89F5CE71B2C255C1CF35E2
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:11
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                                            Start time:06:08:53
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:17
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:20
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:21
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:22
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:24
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                                            Start time:06:08:54
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                                            Start time:06:08:55
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                                            Start time:06:08:55
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:28
                                                                                                                                                                                                            Start time:06:08:55
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:29
                                                                                                                                                                                                            Start time:06:08:55
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:30
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:34
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:35
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:36
                                                                                                                                                                                                            Start time:06:08:56
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                                            Start time:06:08:57
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                                            Start time:06:08:57
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                                            Start time:06:08:57
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:40
                                                                                                                                                                                                            Start time:06:08:57
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:41
                                                                                                                                                                                                            Start time:06:08:58
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:42
                                                                                                                                                                                                            Start time:06:08:58
                                                                                                                                                                                                            Start date:28/12/2024
                                                                                                                                                                                                            Path:C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\FoPwVAmUWJRKQDKEQtsCbGxUBxjOXWMRfIaJbqWbfVLsWIEAsTtOljzADqR\LMrDJmjGiVuMmdtVXtMTEmE.exe"
                                                                                                                                                                                                            Imagebase:0xaa0000
                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:13.7%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:12.6%
                                                                                                                                                                                                              Total number of Nodes:364
                                                                                                                                                                                                              Total number of Limit Nodes:12
                                                                                                                                                                                                              execution_graph 1504 401040 1507 401000 EndTask 1504->1507 1508 401015 1507->1508 1907 402400 1908 402492 1907->1908 1910 40241e 1907->1910 1910->1908 1911 402308 RtlUnwind 1910->1911 1912 402320 1911->1912 1912->1910 1913 403c42 1914 403c51 1913->1914 1915 403c56 MultiByteToWideChar 1914->1915 1916 403cbc 1914->1916 1915->1916 1917 403c6f LCMapStringW 1915->1917 1917->1916 1918 403c8a 1917->1918 1919 403c90 1918->1919 1921 403cd0 1918->1921 1919->1916 1920 403c9e LCMapStringW 1919->1920 1920->1916 1921->1916 1922 403d08 LCMapStringW 1921->1922 1922->1916 1923 403d20 WideCharToMultiByte 1922->1923 1923->1916 1925 4018c3 1932 401955 1925->1932 1927 4018ce 1928 4018dc 1927->1928 1929 4024d8 7 API calls 1927->1929 1930 402511 7 API calls 1928->1930 1929->1928 1931 4018e5 1930->1931 1933 401966 23 API calls 1932->1933 1934 401962 1933->1934 1934->1927 1509 4030c5 1511 4030d8 1509->1511 1510 403111 HeapAlloc 1510->1511 1515 40313c 1510->1515 1511->1510 1511->1515 1516 40268d 1511->1516 1531 4034e6 1511->1531 1539 4026ee LeaveCriticalSection 1511->1539 1517 4026e3 EnterCriticalSection 1516->1517 1518 4026a5 1516->1518 1517->1511 1540 402c80 1518->1540 1521 4026bb 1523 40268d 18 API calls 1521->1523 1524 4026c3 1523->1524 1525 4026d4 1524->1525 1526 4026ca InitializeCriticalSection 1524->1526 1549 402b39 1525->1549 1529 4026d9 1526->1529 1562 4026ee LeaveCriticalSection 1529->1562 1530 4026e1 1530->1517 1535 403518 1531->1535 1532 4035c0 1613 4038a0 1532->1613 1535->1532 1538 4035d4 1535->1538 1606 4037ef 1535->1606 1538->1511 1539->1511 1563 402c92 1540->1563 1543 4018ce 1544 4018d7 1543->1544 1545 4018dc 1543->1545 1578 4024d8 1544->1578 1584 402511 1545->1584 1550 402b42 1549->1550 1551 402b7f 1549->1551 1552 40268d 19 API calls 1550->1552 1551->1529 1553 402b49 1552->1553 1554 402b55 1553->1554 1555 402b68 1553->1555 1598 4031bb 1554->1598 1605 4026ee LeaveCriticalSection 1555->1605 1558 402b6f HeapFree 1558->1551 1559 402b5c 1604 4026ee LeaveCriticalSection 1559->1604 1561 402b63 1561->1529 1562->1530 1564 4026ad 1563->1564 1566 402c99 1563->1566 1564->1521 1564->1543 1566->1564 1567 402cbe 1566->1567 1568 402ccc 1567->1568 1569 402ce2 1567->1569 1570 40268d 19 API calls 1568->1570 1571 402cf4 HeapAlloc 1569->1571 1573 402ce9 1569->1573 1572 402cd3 1570->1572 1571->1573 1574 4034e6 5 API calls 1572->1574 1573->1566 1575 402cd9 1574->1575 1577 4026ee LeaveCriticalSection 1575->1577 1577->1569 1579 4024e2 1578->1579 1580 40250f 1579->1580 1581 402511 7 API calls 1579->1581 1580->1545 1582 4024f9 1581->1582 1583 402511 7 API calls 1582->1583 1583->1580 1585 402524 1584->1585 1586 40263b 1585->1586 1587 402564 1585->1587 1592 4018e5 1585->1592 1589 40264e GetStdHandle WriteFile 1586->1589 1588 402570 GetModuleFileNameA 1587->1588 1587->1592 1590 402588 1588->1590 1589->1592 1593 40399b 1590->1593 1592->1521 1594 4039a8 LoadLibraryA 1593->1594 1595 4039ea 1593->1595 1594->1595 1596 4039b9 GetProcAddress 1594->1596 1595->1592 1596->1595 1597 4039d0 GetProcAddress GetProcAddress 1596->1597 1597->1595 1600 403202 1598->1600 1599 4033f4 VirtualFree 1601 403458 1599->1601 1600->1599 1603 4034ae 1600->1603 1602 403467 VirtualFree HeapFree 1601->1602 1601->1603 1602->1603 1603->1559 1604->1561 1605->1558 1607 403832 HeapAlloc 1606->1607 1608 403802 HeapReAlloc 1606->1608 1610 4035b7 1607->1610 1611 403858 VirtualAlloc 1607->1611 1609 403821 1608->1609 1608->1610 1609->1607 1610->1532 1610->1538 1611->1610 1612 403872 HeapFree 1611->1612 1612->1610 1614 4038b2 VirtualAlloc 1613->1614 1616 4035c6 1614->1616 1616->1538 1617 4017c6 GetVersion 1649 4022c9 HeapCreate 1617->1649 1619 401824 1620 401831 1619->1620 1621 401829 1619->1621 1656 4021fb 1620->1656 1745 4018f3 1621->1745 1625 401836 1626 401842 1625->1626 1627 40183a 1625->1627 1666 40203f 1626->1666 1628 4018f3 8 API calls 1627->1628 1630 401841 1628->1630 1630->1626 1631 40184c GetCommandLineA 1680 401f0d 1631->1680 1635 401866 1703 401c07 1635->1703 1637 40186b 1638 401870 GetStartupInfoA 1637->1638 1716 401baf 1638->1716 1640 401882 1641 40188b 1640->1641 1642 401894 GetModuleHandleA 1641->1642 1720 401600 1642->1720 1650 4022e9 1649->1650 1651 4022fe 1649->1651 1768 403152 HeapAlloc 1650->1768 1651->1619 1654 402301 1654->1619 1655 4022f2 HeapDestroy 1655->1651 1770 402664 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 1656->1770 1658 402201 TlsAlloc 1659 402211 1658->1659 1660 40224b 1658->1660 1771 4030c5 1659->1771 1660->1625 1662 40221a 1662->1660 1663 402222 TlsSetValue 1662->1663 1663->1660 1664 402233 1663->1664 1665 402239 GetCurrentThreadId 1664->1665 1665->1625 1667 402c80 20 API calls 1666->1667 1668 402052 1667->1668 1669 402060 GetStartupInfoA 1668->1669 1670 4018ce 7 API calls 1668->1670 1672 4020ae 1669->1672 1673 40217f 1669->1673 1670->1669 1672->1673 1677 402c80 20 API calls 1672->1677 1679 402125 1672->1679 1674 4021aa GetStdHandle 1673->1674 1675 4021ea SetHandleCount 1673->1675 1674->1673 1676 4021b8 GetFileType 1674->1676 1675->1631 1676->1673 1677->1672 1678 402147 GetFileType 1678->1679 1679->1673 1679->1678 1681 401f28 GetEnvironmentStringsW 1680->1681 1682 401f5b 1680->1682 1683 401f30 1681->1683 1685 401f3c GetEnvironmentStrings 1681->1685 1682->1683 1684 401f4c 1682->1684 1687 401f74 WideCharToMultiByte 1683->1687 1688 401f68 GetEnvironmentStringsW 1683->1688 1686 40185c 1684->1686 1689 401ffa 1684->1689 1690 401fee GetEnvironmentStrings 1684->1690 1685->1684 1685->1686 1751 401cc0 1686->1751 1692 401fa8 1687->1692 1693 401fda FreeEnvironmentStringsW 1687->1693 1688->1686 1688->1687 1694 402c80 20 API calls 1689->1694 1690->1686 1690->1689 1695 402c80 20 API calls 1692->1695 1693->1686 1696 402015 1694->1696 1697 401fae 1695->1697 1699 40202b FreeEnvironmentStringsA 1696->1699 1697->1693 1698 401fb7 WideCharToMultiByte 1697->1698 1700 401fd1 1698->1700 1701 401fc8 1698->1701 1699->1686 1700->1693 1702 402b39 20 API calls 1701->1702 1702->1700 1704 401c14 1703->1704 1705 401c19 1703->1705 1779 402b1d 1704->1779 1707 402c80 20 API calls 1705->1707 1708 401c46 1707->1708 1710 4018ce 7 API calls 1708->1710 1715 401c5a 1708->1715 1709 401c9d 1711 402b39 20 API calls 1709->1711 1710->1715 1712 401ca9 1711->1712 1712->1637 1713 402c80 20 API calls 1713->1715 1714 4018ce 7 API calls 1714->1715 1715->1709 1715->1713 1715->1714 1717 401bb8 1716->1717 1719 401bbd 1716->1719 1718 402b1d 39 API calls 1717->1718 1718->1719 1719->1640 1838 4015c0 1720->1838 1724 401668 1842 401530 ShowCaret 1724->1842 1726 401678 1727 401530 ShowCaret 1726->1727 1728 40168e ShowCaret ShowCaret 1727->1728 1729 4016c3 1728->1729 1730 4016c5 ShowCaret 1729->1730 1731 4016e4 1730->1731 1732 4016e6 ShowCaret 1731->1732 1844 4015a0 GetPEB 1732->1844 1734 4016ef LoadLibraryA 1845 4014c0 1734->1845 1736 401721 EnumResourceNamesA 1847 401390 ShowCaret 1736->1847 1738 401737 ShowCaret 1739 401765 1738->1739 1740 401782 CreateProcessW 1739->1740 1850 4010d0 1740->1850 1742 401796 ShowCaret 1852 401170 ShowCaret 1742->1852 1744 4017aa 1760 401944 1744->1760 1746 401901 1745->1746 1747 4018fc 1745->1747 1749 402511 7 API calls 1746->1749 1748 4024d8 7 API calls 1747->1748 1748->1746 1750 40190a ExitProcess 1749->1750 1752 401cd2 1751->1752 1753 401cd7 GetModuleFileNameA 1751->1753 1754 402b1d 39 API calls 1752->1754 1755 401cfa 1753->1755 1754->1753 1756 402c80 20 API calls 1755->1756 1757 401d1b 1756->1757 1758 401d2b 1757->1758 1759 4018ce 7 API calls 1757->1759 1758->1635 1759->1758 1871 401966 1760->1871 1763 401a37 1887 402262 GetLastError TlsGetValue 1763->1887 1765 401b68 UnhandledExceptionFilter 1767 4018c0 1765->1767 1766 401a42 1766->1765 1766->1767 1769 4022ee 1768->1769 1769->1654 1769->1655 1770->1658 1773 4030d8 1771->1773 1772 403111 HeapAlloc 1772->1773 1777 40313c 1772->1777 1773->1772 1774 40268d 20 API calls 1773->1774 1775 4034e6 5 API calls 1773->1775 1773->1777 1778 4026ee LeaveCriticalSection 1773->1778 1774->1773 1775->1773 1777->1662 1778->1773 1780 402b26 1779->1780 1781 402b2d 1779->1781 1783 402745 1780->1783 1781->1705 1784 40268d 20 API calls 1783->1784 1785 402755 1784->1785 1794 4028f2 1785->1794 1789 4028ea 1789->1781 1791 402791 GetCPInfo 1793 4027a7 1791->1793 1792 40276c 1807 4026ee LeaveCriticalSection 1792->1807 1793->1792 1799 402998 GetCPInfo 1793->1799 1795 402912 1794->1795 1796 402902 GetOEMCP 1794->1796 1797 40275d 1795->1797 1798 402917 GetACP 1795->1798 1796->1795 1797->1791 1797->1792 1797->1793 1798->1797 1800 4029bb 1799->1800 1806 402a83 1799->1806 1808 403d7d 1800->1808 1805 403b2e 9 API calls 1805->1806 1806->1792 1807->1789 1809 403dae GetStringTypeW 1808->1809 1814 403dc6 1808->1814 1810 403dca GetStringTypeA 1809->1810 1809->1814 1810->1814 1815 402a37 1810->1815 1811 403df1 GetStringTypeA 1811->1815 1813 403e15 1813->1815 1816 403e2b MultiByteToWideChar 1813->1816 1814->1811 1814->1813 1820 403b2e 1815->1820 1816->1815 1817 403e4f 1816->1817 1817->1815 1818 403e89 MultiByteToWideChar 1817->1818 1818->1815 1819 403ea2 GetStringTypeW 1818->1819 1819->1815 1821 403b7a 1820->1821 1822 403b5e LCMapStringW 1820->1822 1825 403be0 1821->1825 1826 403bc3 LCMapStringA 1821->1826 1822->1821 1823 403b82 LCMapStringA 1822->1823 1823->1821 1824 402a5b 1823->1824 1824->1805 1825->1824 1827 403bf6 MultiByteToWideChar 1825->1827 1826->1824 1827->1824 1828 403c20 1827->1828 1828->1824 1829 403c56 MultiByteToWideChar 1828->1829 1829->1824 1830 403c6f LCMapStringW 1829->1830 1830->1824 1831 403c8a 1830->1831 1832 403c90 1831->1832 1834 403cd0 1831->1834 1832->1824 1833 403c9e LCMapStringW 1832->1833 1833->1824 1834->1824 1835 403d08 LCMapStringW 1834->1835 1835->1824 1836 403d20 WideCharToMultiByte 1835->1836 1836->1824 1839 4015d2 GetCurrentProcess 1838->1839 1840 4015e4 SHGetFolderPathW lstrcatW ShellExecuteW 1838->1840 1839->1840 1841 4015a0 GetPEB 1840->1841 1841->1724 1843 401562 1842->1843 1843->1726 1844->1734 1846 4014db 1845->1846 1846->1736 1848 4013bc 1847->1848 1849 401433 VirtualProtect 1848->1849 1849->1738 1851 401108 1850->1851 1851->1742 1853 4014c0 1852->1853 1854 4011b3 NtUnmapViewOfSection ShowCaret 1853->1854 1855 4014c0 1854->1855 1856 4011ec VirtualAllocEx ShowCaret 1855->1856 1857 4014c0 1856->1857 1858 40121b WriteProcessMemory ShowCaret 1857->1858 1859 4012b6 ShowCaret 1858->1859 1860 401237 ShowCaret ShowCaret 1858->1860 1863 4012ea 1859->1863 1861 4014c0 1860->1861 1862 401299 WriteProcessMemory 1861->1862 1862->1859 1862->1860 1864 4012ec ShowCaret 1863->1864 1865 4014c0 1864->1865 1866 401320 WriteProcessMemory ShowCaret ShowCaret 1865->1866 1867 4014c0 1866->1867 1868 40135b Wow64SetThreadContext ShowCaret 1867->1868 1869 4014c0 1868->1869 1870 40137a ResumeThread 1869->1870 1870->1744 1880 401a0b 1871->1880 1874 401977 GetCurrentProcess TerminateProcess 1875 401988 1874->1875 1876 4019f2 1875->1876 1877 4019f9 ExitProcess 1875->1877 1883 401a14 1876->1883 1881 40268d 20 API calls 1880->1881 1882 40196c 1881->1882 1882->1874 1882->1875 1886 4026ee LeaveCriticalSection 1883->1886 1885 4018af 1885->1763 1886->1885 1888 4022bd SetLastError 1887->1888 1889 40227e 1887->1889 1888->1766 1890 4030c5 21 API calls 1889->1890 1891 402287 1890->1891 1892 4022b5 1891->1892 1893 40228f TlsSetValue 1891->1893 1895 4018ce 7 API calls 1892->1895 1893->1892 1894 4022a0 1893->1894 1897 4022a6 GetCurrentThreadId 1894->1897 1896 4022bc 1895->1896 1896->1888 1897->1888 1898 401966 1899 401a0b 20 API calls 1898->1899 1900 40196c 1899->1900 1901 401977 GetCurrentProcess TerminateProcess 1900->1901 1902 401988 1900->1902 1901->1902 1903 4019f2 1902->1903 1904 4019f9 ExitProcess 1902->1904 1905 401a14 LeaveCriticalSection 1903->1905 1906 4019f7 1905->1906 1935 403cf6 1936 403d04 1935->1936 1937 403d08 LCMapStringW 1936->1937 1938 403cbc 1936->1938 1937->1938 1939 403d20 WideCharToMultiByte 1937->1939 1939->1938 1941 4023f8 1944 402400 1941->1944 1942 402492 1943 402308 RtlUnwind 1943->1944 1944->1942 1944->1943 1945 403e7a 1946 403e81 1945->1946 1947 403eb2 1946->1947 1948 403e89 MultiByteToWideChar 1946->1948 1948->1947 1949 403ea2 GetStringTypeW 1948->1949 1949->1947

                                                                                                                                                                                                              Callgraph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              • Opacity -> Relevance
                                                                                                                                                                                                              • Disassembly available
                                                                                                                                                                                                              callgraph 0 Function_00401040 28 Function_00401000 0->28 1 Function_00401440 2 Function_00403C42 90 Function_00404290 2->90 3 Function_00401944 18 Function_00401966 3->18 4 Function_00402745 20 Function_0040296F 4->20 55 Function_0040293C 4->55 75 Function_004026EE 4->75 78 Function_004028F2 4->78 85 Function_0040268D 4->85 94 Function_00402998 4->94 5 Function_0040234A 72 Function_004023DE 5->72 6 Function_00402F4E 7 Function_0040224F 8 Function_00402E50 9 Function_00403F50 10 Function_00403152 11 Function_00403D52 12 Function_00401955 12->18 13 Function_00401D59 14 Function_00404159 15 Function_00401060 58 Function_004014C0 15->58 16 Function_00402262 16->7 62 Function_004030C5 16->62 66 Function_004018CE 16->66 17 Function_00402664 34 Function_00401A0B 18->34 41 Function_00401A14 18->41 45 Function_00401A1D 18->45 19 Function_00404168 21 Function_00401170 21->58 22 Function_00401B75 23 Function_00403E76 24 Function_00403E7A 25 Function_00403D7D 77 Function_00403EF0 25->77 25->90 26 Function_00402F7D 27 Function_00402400 27->5 32 Function_00402308 27->32 27->72 29 Function_00401600 29->21 51 Function_00401530 29->51 29->58 59 Function_004015C0 29->59 67 Function_004010D0 29->67 86 Function_00401390 29->86 96 Function_004015A0 29->96 30 Function_00402703 40 Function_00402714 30->40 31 Function_00401C07 38 Function_00402D10 31->38 44 Function_00402B1D 31->44 54 Function_00402B39 31->54 31->66 84 Function_00402C80 31->84 87 Function_00402B90 31->87 33 Function_00401A09 34->85 35 Function_00401F0D 35->54 35->84 89 Function_00402D90 35->89 36 Function_0040410E 37 Function_00404010 39 Function_00402511 39->38 50 Function_00403A30 39->50 39->87 95 Function_0040399B 39->95 97 Function_00402BA0 39->97 41->75 42 Function_00402E15 43 Function_00401917 43->45 44->4 46 Function_00402320 47 Function_00402328 48 Function_00402E2C 49 Function_00403B2E 49->11 49->90 51->1 52 Function_00401030 53 Function_00401A37 53->16 53->22 54->75 54->85 88 Function_00403190 54->88 102 Function_004031BB 54->102 56 Function_00403C3E 57 Function_0040203F 57->66 57->84 58->1 60 Function_00401CC0 60->13 60->44 60->66 60->84 61 Function_004018C3 61->12 61->39 71 Function_004024D8 61->71 63 Function_00403EC6 62->63 73 Function_004034E6 62->73 62->75 62->77 62->85 64 Function_004017C6 64->3 64->29 64->31 64->35 64->43 64->53 64->57 64->60 65 Function_004022C9 64->65 80 Function_004018F3 64->80 83 Function_004021FB 64->83 100 Function_00401BAF 64->100 65->10 66->39 66->71 67->15 67->58 68 Function_00402FD0 69 Function_004023D5 70 Function_00403FD5 71->39 76 Function_004037EF 73->76 98 Function_004038A0 73->98 74 Function_00403FEC 79 Function_00403CF2 80->39 80->71 81 Function_00403CF6 82 Function_004023F8 82->5 82->32 82->72 83->7 83->17 83->62 92 Function_00402C92 84->92 85->54 85->66 85->75 85->84 85->85 86->58 91 Function_00404190 92->63 104 Function_00402CBE 92->104 93 Function_00402B97 94->25 94->49 99 Function_00402FA8 100->30 100->44 101 Function_004023B2 102->9 103 Function_004024BD 103->5 104->73 104->75 104->85

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 00401170 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 165injectionthreadmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040118E
                                                                                                                                                                                                              • NtUnmapViewOfSection.NTDLL(774B0000,0B813440,00000164,00400000,?,00000000), ref: 004011B3
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 004011B7
                                                                                                                                                                                                              • VirtualAllocEx.KERNELBASE(756E0000,0030B70C,00000164,00400000,0004E000,00003000,00000040,?,00000000), ref: 004011EC
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 004011F0
                                                                                                                                                                                                              • WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,00400000,?,00000400,00000000,?,00000000), ref: 0040121B
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040121F
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 00401239
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040125E
                                                                                                                                                                                                              • WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,0004C000,00015A00,00001E00,00000000,?,00000000), ref: 00401299
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 004012CA
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 004012EE
                                                                                                                                                                                                              • WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,7EFDDFF8,00407114,00000004,00000000,?,00000000), ref: 00401320
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 00401324
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040133B
                                                                                                                                                                                                              • Wow64SetThreadContext.KERNEL32(756E0000,00BA2230,00000168,00406620,?,00000000), ref: 0040135B
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040135F
                                                                                                                                                                                                              • ResumeThread.KERNELBASE(756E0000,000BCC14,00000168,?,00000000), ref: 0040137A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CaretShow$MemoryProcessWrite$Thread$AllocContextResumeSectionUnmapViewVirtualWow64
                                                                                                                                                                                                              • String ID: Hq@$`p@
                                                                                                                                                                                                              • API String ID: 480950890-1281468770
                                                                                                                                                                                                              • Opcode ID: b6b0f8813bb7eff36c5e92e955d4611ca0407a266504072ab683b035350681cc
                                                                                                                                                                                                              • Instruction ID: 1cedc51185f688dccbac480823edada26e59cc5e99e7b06dbe20370140511c73
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b6b0f8813bb7eff36c5e92e955d4611ca0407a266504072ab683b035350681cc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2D510DF5610610AFD344EB59EE91F2637F9FB88704F028169F506E73A5C6B4B821CB68
                                                                                                                                                                                                              Function 00401600 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 138processlibrarystringCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004015C0: GetCurrentProcess.KERNEL32(00000000,?,0040160D,?,00000000), ref: 004015D7
                                                                                                                                                                                                              • SHGetFolderPathW.SHELL32(00000000,-0000002A,00000000,00000000,?), ref: 00401635
                                                                                                                                                                                                              • lstrcatW.KERNEL32(?,\notepad.exe,?,00000000), ref: 00401645
                                                                                                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0040165D
                                                                                                                                                                                                                • Part of subcall function 00401530: ShowCaret.USER32(00000000), ref: 0040154C
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040169B
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040169F
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 004016C7
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 004016E8
                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(advapi32.dll), ref: 004016F4
                                                                                                                                                                                                              • EnumResourceNamesA.KERNEL32(756E0000,02CAC166,00000000,00000015,00401040,00000000,?,00000000), ref: 00401721
                                                                                                                                                                                                                • Part of subcall function 00401390: ShowCaret.USER32(00000000), ref: 00401396
                                                                                                                                                                                                                • Part of subcall function 00401390: VirtualProtect.KERNELBASE(756E0000,0030C13C,00000000), ref: 00401433
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040173B
                                                                                                                                                                                                              • CreateProcessW.KERNEL32(756E0000,002BAF82,?,00000000,?,00000000), ref: 00401782
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 0040179A
                                                                                                                                                                                                                • Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 0040118E
                                                                                                                                                                                                                • Part of subcall function 00401170: NtUnmapViewOfSection.NTDLL(774B0000,0B813440,00000164,00400000,?,00000000), ref: 004011B3
                                                                                                                                                                                                                • Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 004011B7
                                                                                                                                                                                                                • Part of subcall function 00401170: VirtualAllocEx.KERNELBASE(756E0000,0030B70C,00000164,00400000,0004E000,00003000,00000040,?,00000000), ref: 004011EC
                                                                                                                                                                                                                • Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 004011F0
                                                                                                                                                                                                                • Part of subcall function 00401170: WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,00400000,?,00000400,00000000,?,00000000), ref: 0040121B
                                                                                                                                                                                                                • Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 0040121F
                                                                                                                                                                                                                • Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 00401239
                                                                                                                                                                                                                • Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 0040125E
                                                                                                                                                                                                                • Part of subcall function 00401170: WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,0004C000,00015A00,00001E00,00000000,?,00000000), ref: 00401299
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CaretShow$Process$MemoryVirtualWrite$AllocCreateCurrentEnumExecuteFolderLibraryLoadNamesPathProtectResourceSectionShellUnmapViewlstrcat
                                                                                                                                                                                                              • String ID: OPIOOUKHJJTY$\notepad.exe$advapi32.dll$open
                                                                                                                                                                                                              • API String ID: 1655093362-2236918752
                                                                                                                                                                                                              • Opcode ID: 1b204ab233147d46d13166e20a68fa83a0cf2c5b14558259fd0cdf6a8d0390c1
                                                                                                                                                                                                              • Instruction ID: 21d5881589ab2f9bb9e7312981c207e25e63c3dc4e9fed1a4688bf212c1fbff5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b204ab233147d46d13166e20a68fa83a0cf2c5b14558259fd0cdf6a8d0390c1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FC418AB1690300BFE210E760DD42F6B37E9E7C4B44F118539B605FB1E1D9B8A914876D
                                                                                                                                                                                                              Function 00401390 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 50 401390-40143b ShowCaret call 4014c0 * 5 VirtualProtect
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ShowCaret.USER32(00000000), ref: 00401396
                                                                                                                                                                                                              • VirtualProtect.KERNELBASE(756E0000,0030C13C,00000000), ref: 00401433
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CaretProtectShowVirtual
                                                                                                                                                                                                              • String ID: 910$V/
                                                                                                                                                                                                              • API String ID: 3929742858-341175346
                                                                                                                                                                                                              • Opcode ID: baf9333768f30c66eaba00d9cb631bdcffc0c17c59462f0b4dfa1dc181a1cdd6
                                                                                                                                                                                                              • Instruction ID: 7adf0c5093f46c572695bcb1cc4dacb91342d891db2e85d7d2a02cab4f7e0da6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: baf9333768f30c66eaba00d9cb631bdcffc0c17c59462f0b4dfa1dc181a1cdd6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 841151B5201210AFD250EBA5DD85F2777FCEB88754F124229FA0AE32A1C674BD108779
                                                                                                                                                                                                              Function 004037EF Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 65 4037ef-403800 66 403832-403856 HeapAlloc 65->66 67 403802-40381f HeapReAlloc 65->67 69 403882-403884 66->69 70 403858-403870 VirtualAlloc 66->70 68 403821-40382d 67->68 67->69 68->66 73 40389d-40389f 69->73 71 403872-40387c HeapFree 70->71 72 403886-40389b 70->72 71->69 72->73
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(00000000,00000060,00000000,00000000,004035B7,00000000,?,?,?,00401836), ref: 00403817
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,004035B7,00000000,?,?,?,00401836), ref: 0040384B
                                                                                                                                                                                                              • VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,00401836), ref: 00403865
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,?), ref: 0040387C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocHeap$FreeVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3499195154-0
                                                                                                                                                                                                              • Opcode ID: f01af24e2874631ea2779b74758652f445791352bac989eab95b762f4ea42c63
                                                                                                                                                                                                              • Instruction ID: 6faec744670907b242940572656bc554ab04cd7dd9b01d2055736a1d5a4cc04c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f01af24e2874631ea2779b74758652f445791352bac989eab95b762f4ea42c63
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF116D712006209FD7209F18ED449267BF9FB44365711893AF152EA5F0D371A9A6CF48
                                                                                                                                                                                                              Function 00401966 Relevance: 4.6, APIs: 3, Instructions: 51COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 74 401966-401975 call 401a0b 77 401977-401982 GetCurrentProcess TerminateProcess 74->77 78 401988-40199e 74->78 77->78 79 4019a0-4019a7 78->79 80 4019dc-4019f0 call 401a1d 78->80 82 4019a9-4019b5 79->82 83 4019cb-4019db call 401a1d 79->83 91 4019f2-4019f8 call 401a14 80->91 92 4019f9-401a03 ExitProcess 80->92 86 4019b7-4019bb 82->86 87 4019ca 82->87 83->80 88 4019bd 86->88 89 4019bf-4019c8 86->89 87->83 88->89 89->86 89->87
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,00401951,?,00000000,00000000,004018AF,00000000,00000000), ref: 0040197B
                                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,00401951,?,00000000,00000000,004018AF,00000000,00000000), ref: 00401982
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00401A03
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                              • Opcode ID: 71278d1f4220bcb8620912db61f9dc75cd8a913f590e7f49d4acebac21ec4584
                                                                                                                                                                                                              • Instruction ID: 6cdff9f0591df1e3503e952f8288832a1c9edc8ebce298b207857a9186d4ea9a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 71278d1f4220bcb8620912db61f9dc75cd8a913f590e7f49d4acebac21ec4584
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA01C0B12412019EDA109B69FE99A1EBBA4EB80350B11403FF4827B1F0CB399850DE6D
                                                                                                                                                                                                              Function 004022C9 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 95 4022c9-4022e7 HeapCreate 96 4022e9-4022f0 call 403152 95->96 97 4022fe-402300 95->97 100 402301-402304 96->100 101 4022f2-4022f8 HeapDestroy 96->101 101->97
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapCreate.KERNELBASE(00000000,00001000,00000000,00401824,00000001), ref: 004022DA
                                                                                                                                                                                                                • Part of subcall function 00403152: HeapAlloc.KERNEL32(00000000,00000140,004022EE), ref: 0040315F
                                                                                                                                                                                                              • HeapDestroy.KERNEL32 ref: 004022F8
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocCreateDestroy
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2236781399-0
                                                                                                                                                                                                              • Opcode ID: 60b094575c43ce829687a51dfa7d6f82ea7a4c2e4d015bc827a296030f121e6a
                                                                                                                                                                                                              • Instruction ID: 40c72eb45e5c1eccc1a22d81960c52d894ac1ab4987cbc5cee3b80ace42f3743
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60b094575c43ce829687a51dfa7d6f82ea7a4c2e4d015bc827a296030f121e6a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57E01275610300AAFF101B31EF49B6B3AD5EB44782F058436B805E81E0E7B489D0A958
                                                                                                                                                                                                              Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 114 401000-401013 EndTask 115 401024 114->115 116 401015 114->116 117 401019-401022 116->117 117->115 117->117
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Task
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4065096731-0
                                                                                                                                                                                                              • Opcode ID: 14f1c2be7496dc62ca041e2660ef3e8e0519321bab3e56e9faf973b6ea3495f4
                                                                                                                                                                                                              • Instruction ID: 333b99c93a70b1c55f9c9043c7c8b5c49931c667e1abf1932cd73e56e3ef5478
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14f1c2be7496dc62ca041e2660ef3e8e0519321bab3e56e9faf973b6ea3495f4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88D0A73C1483C159DA118E108811BA27B515F93B4CF2880DEE5C42F7E3C1365C47D725
                                                                                                                                                                                                              Function 004030C5 Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 118 4030c5-4030d6 119 4030e5-4030ea 118->119 120 4030d8-4030da 118->120 123 403126-40312d 119->123 124 4030ec-4030f2 119->124 121 4030dc-4030de 120->121 122 4030df-4030e2 120->122 121->122 122->119 125 403148 123->125 126 40312f-403138 call 403ec6 123->126 127 403111-403124 HeapAlloc 124->127 128 4030f4-4030fc call 40268d call 4034e6 124->128 130 40314a-40314d 125->130 134 40313a 126->134 135 40314e-403150 126->135 127->123 127->125 137 403101-40310f call 4026ee 128->137 134->119 135->130 137->127 140 40313c-403145 call 403ef0 137->140 140->125
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000008,?,?,?,?,0040221A,00000001,00000074,?,00401836), ref: 0040311A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                              • Opcode ID: be1dcb0f2ca5d9915bb146dd65e79aac8d54812c6b123a79e5cb88223f99ff47
                                                                                                                                                                                                              • Instruction ID: 63a47281f7fccb9a522bad3f45b21b828df9063caa348d8c451a67992f3c2ab6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: be1dcb0f2ca5d9915bb146dd65e79aac8d54812c6b123a79e5cb88223f99ff47
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 73019C33A0161027E9212E255D41B5F3A1D9B84BB7F1A0237FC507B3C2D67D8E0141DD

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 0040399B Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 179 40399b-4039a6 180 4039a8-4039b7 LoadLibraryA 179->180 181 4039ea-4039f1 179->181 182 403a20-403a22 180->182 183 4039b9-4039ce GetProcAddress 180->183 184 4039f3-4039f9 181->184 185 403a09-403a15 181->185 186 403a1c-403a1f 182->186 183->182 187 4039d0-4039e5 GetProcAddress * 2 183->187 184->185 189 4039fb-403a02 184->189 185->186 187->181 189->185 190 403a04-403a07 189->190 190->185
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(user32.dll), ref: 004039AD
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004039C5
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004039D6
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 004039E3
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                              • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                                                                                                                                              • API String ID: 2238633743-4044615076
                                                                                                                                                                                                              • Opcode ID: 56fcd12e22422f3926956bab43dc5e187367ba90ba411f881e403aaca0228d71
                                                                                                                                                                                                              • Instruction ID: a479ffe80b3d4e596aad1b70f613aa0b77e146be3452bb55d1156979b56034e0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 56fcd12e22422f3926956bab43dc5e187367ba90ba411f881e403aaca0228d71
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E20175317003029BC710EFF56D80D1B7EECD649792315443FA542F22A1D6B8C811AF6D
                                                                                                                                                                                                              Function 004017C6 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetVersion.KERNEL32 ref: 004017EC
                                                                                                                                                                                                                • Part of subcall function 004022C9: HeapCreate.KERNELBASE(00000000,00001000,00000000,00401824,00000001), ref: 004022DA
                                                                                                                                                                                                                • Part of subcall function 004022C9: HeapDestroy.KERNEL32 ref: 004022F8
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 0040184C
                                                                                                                                                                                                              • GetStartupInfoA.KERNEL32 ref: 00401877
                                                                                                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040189A
                                                                                                                                                                                                                • Part of subcall function 004018F3: ExitProcess.KERNEL32 ref: 00401910
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2057626494-0
                                                                                                                                                                                                              • Opcode ID: 580e609f3b58203afaf02fb415f8282007d0353eaa0aedd914cb555909b1db8c
                                                                                                                                                                                                              • Instruction ID: 7f32cd8fe34967029b0e80cb92399a2b70a2c6a079cbf2585e16a7e0bb248895
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 580e609f3b58203afaf02fb415f8282007d0353eaa0aedd914cb555909b1db8c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E2160B19407059BDB08BBA5DD4AA6E7BA8FF04714F10403FF905BA2E1DB788940CB58
                                                                                                                                                                                                              Function 004015A0 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 6fa4123895c06758eaf40f989013f674dad0268acc882292ff0069a38350e771
                                                                                                                                                                                                              • Instruction ID: afa9b4d82ea807fe5f26d476e808ebe513a973cbf3cbef0d3ac3cb0c14153526
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6fa4123895c06758eaf40f989013f674dad0268acc882292ff0069a38350e771
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E1C08C3290764CEBCB02CB8ED901A59F7FCEFD1A10F10019BE80493A1092F52F0488A0
                                                                                                                                                                                                              Function 00402511 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 144 402511-40251f 145 402524-402526 144->145 146 402533-40253f 145->146 147 402528-402531 145->147 148 402661-402663 146->148 149 402545-40254d 146->149 147->145 147->146 150 402553-402555 149->150 151 40263b-40265b call 402d10 GetStdHandle WriteFile 149->151 152 402564-40256a 150->152 153 402557-40255e 150->153 151->148 152->148 155 402570-402586 GetModuleFileNameA 152->155 153->151 153->152 157 402588-40259a call 402b90 155->157 158 40259b-4025b3 call 402d10 155->158 157->158 163 4025b5-4025db call 402d10 call 403a30 158->163 164 4025de-402639 call 402b90 call 402ba0 * 3 call 40399b 158->164 163->164 164->148
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0040257E
                                                                                                                                                                                                              • GetStdHandle.KERNEL32(000000F4,00405348,00000000,?,00000000,?), ref: 00402654
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000), ref: 0040265B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$HandleModuleNameWrite
                                                                                                                                                                                                              • String ID: ...$<program name unknown>$Hb@$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                                                                                                              • API String ID: 3784150691-3053371217
                                                                                                                                                                                                              • Opcode ID: 0c2281f3aa94957885efe1dd98b9d45b276729d5152b46fa3ea8c28481f0212a
                                                                                                                                                                                                              • Instruction ID: dc953bc63a9f778bc1b12ee88897f7fe90698b9d6db9149e529bfef901ecca1e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c2281f3aa94957885efe1dd98b9d45b276729d5152b46fa3ea8c28481f0212a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB3185726002186EDF20EA60CE49F9B776CEF45304F50047BF945F61C1D6B8AA948E59
                                                                                                                                                                                                              Function 00403B2E Relevance: 13.7, APIs: 9, Instructions: 177COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 192 403b2e-403b5c 193 403ba4-403ba7 192->193 194 403b5e-403b78 LCMapStringW 192->194 197 403bb9-403bc1 193->197 198 403ba9-403bb6 call 403d52 193->198 195 403b82-403b94 LCMapStringA 194->195 196 403b7a-403b80 194->196 199 403b9a 195->199 200 403cbc 195->200 196->193 202 403be0-403be3 197->202 203 403bc3-403bdb LCMapStringA 197->203 198->197 199->193 204 403cbe-403ccf 200->204 202->200 206 403be9-403bec 202->206 203->204 207 403bf6-403c1a MultiByteToWideChar 206->207 208 403bee-403bf3 206->208 207->200 209 403c20-403c54 call 404290 207->209 208->207 209->200 213 403c56-403c6d MultiByteToWideChar 209->213 213->200 214 403c6f-403c88 LCMapStringW 213->214 214->200 215 403c8a-403c8e 214->215 216 403cd0-403d06 call 404290 215->216 217 403c90-403c93 215->217 216->200 224 403d08-403d1e LCMapStringW 216->224 218 403c99-403c9c 217->218 219 403d4b-403d4d 217->219 218->200 221 403c9e-403cb6 LCMapStringW 218->221 219->204 221->200 221->219 224->200 225 403d20-403d25 224->225 226 403d27-403d29 225->226 227 403d2b-403d2e 225->227 228 403d31-403d45 WideCharToMultiByte 226->228 227->228 228->200 228->219
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LCMapStringW.KERNEL32(00000000,00000100,00405414,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403B70
                                                                                                                                                                                                              • LCMapStringA.KERNEL32(00000000,00000100,00405410,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403B8C
                                                                                                                                                                                                              • LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403BD5
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403C0D
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000001,00000020,00000001,00000100,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403C65
                                                                                                                                                                                                              • LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403C7B
                                                                                                                                                                                                              • LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403CAE
                                                                                                                                                                                                              • LCMapStringW.KERNEL32(?,00000100,00000100,00000100,?,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403D16
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: String$ByteCharMultiWide
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 352835431-0
                                                                                                                                                                                                              • Opcode ID: 9b1fb0eaeae7abdf1945f3128f7ae684e41b35706a3eb2943a3cdfd2cbdd8426
                                                                                                                                                                                                              • Instruction ID: 1c21f9441693a9a0395c5586c8818974786ee025f7665dbb4546bf95d124890a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b1fb0eaeae7abdf1945f3128f7ae684e41b35706a3eb2943a3cdfd2cbdd8426
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D519C72900209ABDF219F94CD45ADF7FB8FB88755F10412AF910B12A0C3399E61DBA9
                                                                                                                                                                                                              Function 00401F0D Relevance: 12.1, APIs: 8, Instructions: 132COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 229 401f0d-401f26 230 401f28-401f2e GetEnvironmentStringsW 229->230 231 401f5b-401f5e 229->231 234 401f30-401f3a 230->234 235 401f3c-401f46 GetEnvironmentStrings 230->235 232 401f64-401f66 231->232 233 401fe5-401fe8 231->233 238 401f74-401f79 232->238 239 401f68-401f6e GetEnvironmentStringsW 232->239 236 402036 233->236 237 401fea-401fec 233->237 234->232 235->236 240 401f4c-401f56 235->240 245 402038-40203e 236->245 241 401ffa-401ffe 237->241 242 401fee-401ff8 GetEnvironmentStrings 237->242 243 401f89-401fa6 WideCharToMultiByte 238->243 244 401f7b-401f80 238->244 239->236 239->238 240->237 246 402000-402003 241->246 247 40200a-40201a call 402c80 241->247 242->236 242->241 249 401fa8-401fb5 call 402c80 243->249 250 401fda-401fe3 FreeEnvironmentStringsW 243->250 244->244 248 401f82-401f87 244->248 246->246 251 402005-402008 246->251 256 402020-402028 call 402d90 247->256 257 40201c-40201e 247->257 248->243 248->244 249->250 258 401fb7-401fc6 WideCharToMultiByte 249->258 250->245 251->246 251->247 259 40202b-402034 FreeEnvironmentStringsA 256->259 257->259 261 401fd6 258->261 262 401fc8-401fd2 call 402b39 258->262 259->245 261->250 262->261
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401F28
                                                                                                                                                                                                              • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401F3C
                                                                                                                                                                                                              • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401F68
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0040185C), ref: 00401FA0
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0040185C), ref: 00401FC2
                                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0040185C), ref: 00401FDB
                                                                                                                                                                                                              • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401FEE
                                                                                                                                                                                                              • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040202C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1823725401-0
                                                                                                                                                                                                              • Opcode ID: 6cc6b04491aafc98d39791db8cca144a75cc353a196cdcde92c063c0bf283cdb
                                                                                                                                                                                                              • Instruction ID: 3866f0483314f29f1618ff4dfa568d2e56ff3937cd63a0f44ec9b139913bb891
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6cc6b04491aafc98d39791db8cca144a75cc353a196cdcde92c063c0bf283cdb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2931E5B25043126FE7203F755DC883F769CE645358B11053BFA42F32D0EAB94C4186AD
                                                                                                                                                                                                              Function 0040203F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 266 40203f-402057 call 402c80 269 402061-402071 266->269 270 402059-402060 call 4018ce 266->270 272 402077-402079 269->272 270->269 274 402099-4020a8 GetStartupInfoA 272->274 275 40207b-402097 272->275 276 4020ae-4020b3 274->276 277 40217f 274->277 275->272 276->277 278 4020b9-4020cb 276->278 279 402181-402191 277->279 280 4020cd 278->280 281 4020cf-4020d5 278->281 282 4021e0 279->282 283 402193-402199 279->283 280->281 285 4020d7 281->285 286 40212d-402131 281->286 284 4021e4-4021e8 282->284 287 4021a0-4021a7 283->287 288 40219b-40219e 283->288 284->279 291 4021ea-4021fa SetHandleCount 284->291 292 4020dc-4020e9 call 402c80 285->292 286->277 290 402133-40213b 286->290 289 4021aa-4021b6 GetStdHandle 287->289 288->289 293 4021b8-4021c1 GetFileType 289->293 294 4021cf-4021d3 289->294 295 402175-40217d 290->295 296 40213d-402141 290->296 304 402127 292->304 305 4020eb-4020f4 292->305 293->294 298 4021c3-4021cd 293->298 294->284 295->277 295->290 296->295 299 402143-402145 296->299 298->294 301 4021d5-4021d8 298->301 302 402152-402172 299->302 303 402147-402150 GetFileType 299->303 301->284 307 4021da-4021de 301->307 302->295 303->295 303->302 304->286 306 4020fa-4020fc 305->306 308 40211a-402123 306->308 309 4020fe-402118 306->309 307->284 308->292 310 402125 308->310 309->306 310->286
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetStartupInfoA.KERNEL32 ref: 0040209D
                                                                                                                                                                                                              • GetFileType.KERNEL32 ref: 00402148
                                                                                                                                                                                                              • GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004021AB
                                                                                                                                                                                                              • GetFileType.KERNEL32 ref: 004021B9
                                                                                                                                                                                                              • SetHandleCount.KERNEL32 ref: 004021F0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileHandleType$CountInfoStartup
                                                                                                                                                                                                              • String ID: $n@
                                                                                                                                                                                                              • API String ID: 1710529072-1302802583
                                                                                                                                                                                                              • Opcode ID: 400b9e1c09f4c8b4246377677c855733b0a7004988ecaecd724ee2ff353f4308
                                                                                                                                                                                                              • Instruction ID: caac54b683a96beeea0f3893d81dbd00cf7c5e2421639fb466baf6c3d4da63b4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 400b9e1c09f4c8b4246377677c855733b0a7004988ecaecd724ee2ff353f4308
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7F5128315003028BD7108B28DE4C72A7BE1EB15324F25467ED656BF3E1DBB88806CB59
                                                                                                                                                                                                              Function 00403D7D Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetStringTypeW.KERNEL32(00000001,00405414,00000001,00000000,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403DBC
                                                                                                                                                                                                              • GetStringTypeA.KERNEL32(00000000,00000001,00405410,00000001,00000000,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403DD6
                                                                                                                                                                                                              • GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403E0A
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00402A37,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403E42
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00402A37,00000001,00000100,00000020,?,00000100,?,00000100,00000000,00402A37,00000001,00000020,00000100,?), ref: 00403E98
                                                                                                                                                                                                              • GetStringTypeW.KERNEL32(?,?,00000000,00000001,?,00000100,?,00000100,00000000,00402A37,00000001,00000020,00000100,?), ref: 00403EAA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: StringType$ByteCharMultiWide
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3852931651-0
                                                                                                                                                                                                              • Opcode ID: 07bb9862341e01356d0dff1c427b7db7969236951c1baf01262c24fa338bcbd1
                                                                                                                                                                                                              • Instruction ID: 0f8efcfe3fc3890c713297aeb0959f0275bfe311c219aa286c24befefaedaadf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 07bb9862341e01356d0dff1c427b7db7969236951c1baf01262c24fa338bcbd1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6C417B71A00219AFCF219F94DD85AEF7FB9EB08711F104536FA01E6290C3399E508BE9
                                                                                                                                                                                                              Function 00402262 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 00402264
                                                                                                                                                                                                              • TlsGetValue.KERNEL32(?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 00402272
                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 004022BE
                                                                                                                                                                                                                • Part of subcall function 004030C5: HeapAlloc.KERNEL32(00000008,?,?,?,?,0040221A,00000001,00000074,?,00401836), ref: 0040311A
                                                                                                                                                                                                              • TlsSetValue.KERNEL32(00000000,?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 00402296
                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32(?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 004022A7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2020098873-0
                                                                                                                                                                                                              • Opcode ID: 335a875935f7b19f5e8a0b5442704e984695624e2c3f9a47eb943db27249e189
                                                                                                                                                                                                              • Instruction ID: f9de0d5041fc25c08b20143062fd2b82a10856d808b46f2208d999d265b65f83
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 335a875935f7b19f5e8a0b5442704e984695624e2c3f9a47eb943db27249e189
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0BF0BB32601A115BD7312F71BF0DA5F3A54EF01B71715027EF945BA2E0DB7988014AE8
                                                                                                                                                                                                              Function 00402998 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCPInfo.KERNEL32(?,00000000), ref: 004029AC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Info
                                                                                                                                                                                                              • String ID: $
                                                                                                                                                                                                              • API String ID: 1807457897-3032137957
                                                                                                                                                                                                              • Opcode ID: eee52de4ef1d4b68b42ec2e047e9f4f22a41eb0dfe49c41ee4b0386842691e7c
                                                                                                                                                                                                              • Instruction ID: 926cd45f255bbb82106f54f5591ecb558f37e935955913c86844fdd4412d6bab
                                                                                                                                                                                                              • Opcode Fuzzy Hash: eee52de4ef1d4b68b42ec2e047e9f4f22a41eb0dfe49c41ee4b0386842691e7c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88415A312042585AFB219B14DF4DBFB3FA9EB01704F1500F6D586F61D2C6B94A54CBAA
                                                                                                                                                                                                              Function 00402664 Relevance: 5.0, APIs: 4, Instructions: 12COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402671
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402679
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402681
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402689
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.346868018.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.346862897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346873284.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.346880130.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalInitializeSection
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 32694325-0
                                                                                                                                                                                                              • Opcode ID: cf65fcc1aeab1ef7e16435afcb5f7beaf118cbbb08b94427fa8083d0bb468be8
                                                                                                                                                                                                              • Instruction ID: 48065476d1b059bde1b2936bcb0e38e24f7665c16bd3e9ed4f641355b81c547b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cf65fcc1aeab1ef7e16435afcb5f7beaf118cbbb08b94427fa8083d0bb468be8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 16C0E931A070249ACB513B75FE0484A3E25EB0426031640BAA5096203486331830DFD8

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:7.1%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                              Signature Coverage:10.4%
                                                                                                                                                                                                              Total number of Nodes:374
                                                                                                                                                                                                              Total number of Limit Nodes:16
                                                                                                                                                                                                              execution_graph 6686 405f09 6687 405f10 6686->6687 6688 405fe4 6687->6688 6689 405ffc 6687->6689 6691 4056e0 22 API calls 6688->6691 6690 406033 6689->6690 6693 406010 6689->6693 6694 4056e0 22 API calls 6689->6694 6692 405fed 6691->6692 6695 405820 40 API calls 6693->6695 6694->6693 6695->6693 5115 410910 memset 5150 40a5d0 5115->5150 5117 41093d GetProcessHeap memset GetModuleFileNameA 5118 41098c 5117->5118 5119 4109cf GetTickCount 5117->5119 5152 40f2b0 5118->5152 5122 4109db 5119->5122 5121 4109a7 5121->5119 5123 4109ae ShellExecuteA 5121->5123 5124 4109f3 Sleep OpenMutexA 5122->5124 5123->5119 5125 410a21 GetLastError 5124->5125 5126 410a38 lstrlenA 5124->5126 5125->5126 5127 410a2e GetLastError ExitProcess 5125->5127 5161 401e60 5126->5161 5131 410a71 5132 410a78 ExitProcess 5131->5132 5133 410a7f 5131->5133 5191 4073e0 memset memset 5133->5191 5135 410a8e 5136 410a96 ExitProcess 5135->5136 5137 410a9e 5135->5137 5203 407330 memset 5137->5203 5141 410ab4 5220 406850 SHGetSpecialFolderPathW 5141->5220 5143 410abe GetModuleFileNameW wsprintfW WideCharToMultiByte lstrcpynW WideCharToMultiByte 5144 410b4a 5143->5144 5145 410b5f 5143->5145 5221 40a990 5144->5221 5228 405ce0 5145->5228 5148 410b6b ExitProcess 5149 410b4f Sleep 5149->5145 5151 40a5e5 5150->5151 5151->5117 5242 403810 GetProcessHeap RtlAllocateHeap 5152->5242 5154 40f2ca 5155 40f2d3 5154->5155 5156 40f2db sprintf CreateFileA 5154->5156 5155->5121 5157 40f365 5156->5157 5158 40f307 memset DeviceIoControl CloseHandle 5156->5158 5243 4037f0 GetProcessHeap HeapFree 5157->5243 5158->5157 5160 40f37b 5160->5121 5162 401e6f _snprintf 5161->5162 5163 404d00 5162->5163 5165 404d0e 5163->5165 5164 404d16 5164->5131 5165->5164 5244 403a20 5165->5244 5167 404d33 5168 404d37 5167->5168 5169 404d3d GetVersionExA 5167->5169 5168->5131 5169->5168 5170 404d56 5169->5170 5249 403f90 5170->5249 5172 404d5c 5259 403390 5172->5259 5174 404d7e 5268 404ae0 5174->5268 5176 404d9b 5290 403ac0 5176->5290 5178 404da6 strncpy 5294 4035d0 5178->5294 5180 404dd0 NtQueryInformationProcess 5181 404e53 5180->5181 5182 404ddc 5180->5182 5295 403890 5181->5295 5316 403440 5182->5316 5185 404e67 5303 403750 5185->5303 5187 404dee 5187->5181 5188 404e6d 5307 404c20 5188->5307 5190 404e7e 5190->5131 5192 407430 lstrlenA 5191->5192 5193 407453 _vsnprintf lstrlenA 5191->5193 5192->5193 5195 407437 _snprintf 5192->5195 5386 404900 5193->5386 5195->5193 5196 407495 5197 4074a8 _memicmp 5196->5197 5198 40749c 5196->5198 5199 4074bc _vsnprintf 5197->5199 5200 4074ee 5197->5200 5198->5135 5401 40a310 5199->5401 5200->5135 5202 4074eb 5202->5200 5204 407368 lstrlenA 5203->5204 5205 40738b _vsnprintf lstrlenA 5203->5205 5204->5205 5206 40736f _snprintf 5204->5206 5412 4049f0 5205->5412 5206->5205 5208 4073cc 5209 40b300 GetProcessHeap HeapAlloc memset memset 5208->5209 5210 40b360 5209->5210 5211 40b37b GetWindowsDirectoryW 5209->5211 5210->5141 5211->5210 5212 40b391 lstrcpynW GetVolumeInformationW 5211->5212 5213 40b3c5 5212->5213 5214 40b3cc lstrlenA 5212->5214 5213->5214 5215 40b3f6 5214->5215 5216 40b3de 5214->5216 5218 40b467 5215->5218 5219 40b45b lstrcatW 5215->5219 5217 40b3e0 lstrlenA 5216->5217 5217->5215 5217->5217 5218->5141 5219->5218 5220->5143 5222 40a9a5 5221->5222 5438 4068b0 SHGetSpecialFolderPathW 5222->5438 5224 40a9cd 5225 40a9d1 5224->5225 5226 40a9d6 CreateProcessW 5224->5226 5225->5149 5227 40a9f7 5226->5227 5227->5149 5229 406033 5228->5229 5230 405cf3 5228->5230 5229->5148 5230->5229 5231 405d55 5230->5231 5232 405f86 5230->5232 5233 403440 10 API calls 5231->5233 5234 405fe4 5232->5234 5235 405ffc 5232->5235 5241 405d60 5233->5241 5236 4056e0 22 API calls 5234->5236 5235->5229 5238 406010 5235->5238 5441 4056e0 5235->5441 5237 405fed 5236->5237 5237->5148 5238->5148 5455 405820 memset 5238->5455 5241->5232 5242->5154 5243->5160 5246 403a25 5244->5246 5245 403a2d 5245->5167 5246->5245 5335 4035b0 GetPEB 5246->5335 5248 403a44 5248->5167 5250 403f9f 5249->5250 5253 403fa6 5249->5253 5251 403890 3 API calls 5250->5251 5251->5253 5252 404018 5252->5172 5253->5252 5254 403890 3 API calls 5253->5254 5255 403fd1 5254->5255 5256 403750 2 API calls 5255->5256 5257 403fd7 5256->5257 5257->5252 5258 404003 GetNativeSystemInfo 5257->5258 5258->5252 5260 4033a0 5259->5260 5261 40339b 5259->5261 5336 4030c0 5260->5336 5261->5174 5264 4030c0 RtlInitializeCriticalSection 5266 4033c3 5264->5266 5265 40342e 5265->5174 5266->5265 5340 4031d0 5266->5340 5269 404af2 5268->5269 5270 404b54 5268->5270 5269->5270 5271 404b0d strncpy sprintf CreateMutexA 5269->5271 5270->5176 5272 404b4b 5271->5272 5273 404b5c _snprintf OpenFileMappingA 5271->5273 5355 404880 5272->5355 5275 404b96 CloseHandle 5273->5275 5276 404b9d 5273->5276 5275->5276 5277 404bad 5276->5277 5347 404560 5276->5347 5282 404bd1 5277->5282 5364 404470 5277->5364 5278 404b51 5278->5270 5281 404bbc 5283 404bc8 5281->5283 5284 404bda 5281->5284 5282->5176 5285 404880 3 API calls 5283->5285 5286 404c08 5284->5286 5287 404bde WaitForSingleObject 5284->5287 5288 404bce 5285->5288 5286->5176 5287->5286 5289 404bed ReleaseMutex 5287->5289 5288->5282 5289->5286 5291 403b10 5290->5291 5292 403acc 5290->5292 5291->5178 5292->5291 5293 403ae0 _snprintf 5292->5293 5293->5178 5294->5180 5296 4038a0 5295->5296 5298 4038ae 5295->5298 5370 4035b0 GetPEB 5296->5370 5300 4038c0 RtlAnsiStringToUnicodeString 5298->5300 5299 4038a5 5299->5185 5301 4038f6 LdrGetDllHandle 5300->5301 5302 4038ee 5300->5302 5301->5185 5302->5185 5304 403760 LdrGetProcedureAddress 5303->5304 5305 403784 LdrGetProcedureAddress 5303->5305 5304->5188 5305->5188 5371 4035d0 5307->5371 5309 404c31 OpenProcessToken 5310 404c48 LookupPrivilegeValueA 5309->5310 5311 404c3c GetLastError 5309->5311 5312 404c72 AdjustTokenPrivileges 5310->5312 5313 404c5c GetLastError CloseHandle 5310->5313 5311->5190 5314 404ca3 GetLastError 5312->5314 5315 404ca9 CloseHandle 5312->5315 5313->5190 5314->5315 5315->5190 5317 40359f 5316->5317 5323 403451 5316->5323 5317->5187 5318 40348c printf printf 5320 4034c2 5318->5320 5321 4034c7 printf 5318->5321 5320->5321 5372 4035d0 5321->5372 5322 40355a 5325 403593 5322->5325 5380 403320 5322->5380 5323->5317 5323->5318 5323->5322 5325->5187 5326 4034f1 NtAllocateVirtualMemory 5326->5317 5330 403500 5326->5330 5329 4031d0 2 API calls 5329->5325 5330->5317 5373 403100 5330->5373 5332 40354a 5333 403440 6 API calls 5332->5333 5334 403551 5333->5334 5334->5187 5335->5248 5337 4030f1 5336->5337 5338 4030cb 5336->5338 5337->5264 5338->5337 5339 4030e7 RtlInitializeCriticalSection 5338->5339 5339->5337 5341 403230 5340->5341 5342 4031dc 5340->5342 5341->5265 5342->5341 5343 4031f3 5342->5343 5344 4031e9 EnterCriticalSection 5342->5344 5345 403227 5343->5345 5346 40321d LeaveCriticalSection 5343->5346 5344->5343 5345->5265 5346->5345 5350 40457a 5347->5350 5348 404470 4 API calls 5348->5350 5349 4046fd 5349->5277 5350->5348 5350->5349 5351 4045b9 _snprintf 5350->5351 5352 4045ed CreateFileMappingA 5350->5352 5351->5350 5351->5352 5352->5349 5353 404621 MapViewOfFile 5352->5353 5353->5350 5354 404706 CloseHandle 5353->5354 5354->5277 5356 404890 5355->5356 5357 40488b 5355->5357 5358 4048a4 5356->5358 5359 404897 CloseHandle 5356->5359 5357->5278 5360 4048b7 UnmapViewOfFile 5358->5360 5361 4048cc 5358->5361 5359->5358 5360->5358 5362 4048da CloseHandle 5361->5362 5363 4048ef 5361->5363 5362->5361 5363->5278 5365 404536 5364->5365 5366 40448e _snprintf OpenFileMappingA 5364->5366 5365->5281 5367 404530 5366->5367 5368 4044e2 MapViewOfFile 5366->5368 5367->5281 5368->5365 5369 404516 CloseHandle 5368->5369 5369->5367 5370->5299 5371->5309 5372->5326 5374 403161 5373->5374 5375 40310c 5373->5375 5374->5332 5375->5374 5376 403119 EnterCriticalSection 5375->5376 5377 403123 5375->5377 5376->5377 5378 403158 5377->5378 5379 40314e LeaveCriticalSection 5377->5379 5378->5332 5379->5378 5381 403332 5380->5381 5382 403385 5380->5382 5381->5382 5383 40333c EnterCriticalSection 5381->5383 5384 403346 5381->5384 5382->5329 5383->5384 5384->5382 5385 40337b LeaveCriticalSection 5384->5385 5385->5382 5387 4049df 5386->5387 5388 404910 5386->5388 5387->5196 5388->5387 5389 404933 WaitForSingleObject 5388->5389 5390 404982 5389->5390 5393 404943 5389->5393 5390->5196 5391 404979 ReleaseMutex 5391->5390 5392 404470 _snprintf OpenFileMappingA MapViewOfFile CloseHandle 5392->5393 5393->5390 5393->5391 5393->5392 5394 4049b2 5393->5394 5395 4049a2 ReleaseMutex 5393->5395 5396 404470 4 API calls 5394->5396 5395->5196 5397 4049b7 5396->5397 5398 404470 4 API calls 5397->5398 5399 4049c1 ReleaseMutex 5398->5399 5399->5196 5410 410f10 5401->5410 5404 401e60 5405 40a3ba _snprintf lstrlenA sprintf lstrlenA lstrlenA 5404->5405 5406 40a419 5405->5406 5407 40a431 EnterCriticalSection CreateFileA 5406->5407 5408 40a473 WriteFile CloseHandle Sleep LeaveCriticalSection 5407->5408 5409 40a45f LeaveCriticalSection 5407->5409 5408->5202 5409->5202 5411 40a31d 6 API calls 5410->5411 5411->5404 5413 404a00 5412->5413 5414 404acb 5412->5414 5413->5414 5415 404a0b WaitForSingleObject 5413->5415 5414->5208 5415->5414 5416 404a1e 5415->5416 5417 404560 8 API calls 5416->5417 5420 404a42 5417->5420 5418 404a79 5418->5208 5419 404aad ReleaseMutex 5423 404470 4 API calls 5419->5423 5420->5418 5420->5419 5430 4047c0 5420->5430 5425 404ac6 5423->5425 5424 404a6d 5426 404a80 5424->5426 5427 404a74 ReleaseMutex 5424->5427 5425->5208 5428 404470 4 API calls 5426->5428 5427->5418 5429 404a88 ReleaseMutex 5428->5429 5429->5419 5431 4047d1 5430->5431 5432 404875 5430->5432 5431->5432 5433 4047ed InterlockedIncrement 5431->5433 5432->5424 5436 404807 5433->5436 5434 404560 8 API calls 5434->5436 5435 404470 _snprintf OpenFileMappingA MapViewOfFile CloseHandle 5435->5436 5436->5434 5436->5435 5437 40485c 5436->5437 5437->5424 5439 4068c5 5438->5439 5440 4068c6 PathAppendW 5438->5440 5439->5224 5440->5224 5442 4056f5 5441->5442 5443 4056ef 5441->5443 5467 402cd0 5442->5467 5443->5238 5445 405730 NtQuerySystemInformation 5449 405795 5445->5449 5452 40574b 5445->5452 5446 4057ff 5483 402ca0 5446->5483 5447 405815 5447->5238 5448 402cd0 4 API calls 5448->5452 5449->5446 5475 404410 5449->5475 5452->5447 5452->5448 5454 40577d NtQuerySystemInformation 5452->5454 5453 405808 5453->5238 5454->5449 5454->5452 5465 405882 5455->5465 5456 405898 NtGetNextProcess 5457 405a04 CloseHandle 5456->5457 5456->5465 5457->5238 5458 4058b8 CloseHandle 5459 4058bf NtQueryInformationProcess 5458->5459 5459->5465 5460 4059f7 Sleep 5460->5465 5461 4058eb NtQueryInformationProcess 5461->5465 5462 404900 8 API calls 5462->5465 5463 4049f0 13 API calls 5463->5465 5464 40596b InterlockedCompareExchange 5464->5465 5465->5456 5465->5457 5465->5458 5465->5459 5465->5460 5465->5461 5465->5462 5465->5463 5465->5464 5466 4042e0 15 API calls 5465->5466 5466->5465 5468 402ce4 5467->5468 5469 402cde 5467->5469 5470 402d00 5468->5470 5471 402d3b 5468->5471 5474 402d08 5468->5474 5469->5445 5493 403810 GetProcessHeap RtlAllocateHeap 5470->5493 5488 403830 5471->5488 5474->5445 5476 404418 5475->5476 5477 404420 5476->5477 5478 404424 OpenProcess 5476->5478 5477->5449 5479 404447 5478->5479 5480 40443c GetLastError 5478->5480 5495 4042e0 5479->5495 5480->5449 5482 404456 CloseHandle 5482->5449 5484 402caa 5483->5484 5485 402cac 5483->5485 5484->5453 5486 402cbe 5485->5486 5544 4037f0 GetProcessHeap HeapFree 5485->5544 5486->5453 5489 403848 GetProcessHeap HeapReAlloc 5488->5489 5490 40383a 5488->5490 5489->5474 5494 403810 GetProcessHeap RtlAllocateHeap 5490->5494 5492 403843 5492->5474 5493->5474 5494->5492 5496 4042eb 5495->5496 5497 4042f3 5496->5497 5518 4042a0 5496->5518 5497->5482 5500 404310 5500->5482 5501 404323 VirtualAllocEx 5502 40433a 5501->5502 5503 40439f GetLastError 5501->5503 5504 404341 WriteProcessMemory 5502->5504 5505 404356 5502->5505 5507 4043ba 5503->5507 5508 4043af VirtualFreeEx 5503->5508 5504->5503 5504->5505 5505->5503 5521 404160 5505->5521 5510 4043c1 VirtualFreeEx 5507->5510 5511 4043cc 5507->5511 5508->5507 5509 404374 5509->5503 5512 40437e CreateRemoteThread 5509->5512 5510->5511 5511->5482 5512->5503 5513 4043d5 5512->5513 5536 4037f0 GetProcessHeap HeapFree 5513->5536 5515 4043dc 5516 4043f4 CloseHandle 5515->5516 5517 4043e6 5515->5517 5516->5482 5517->5482 5519 4042ad IsWow64Process 5518->5519 5520 4042bf 5518->5520 5519->5520 5520->5500 5520->5501 5520->5502 5537 404020 5521->5537 5523 40417f VirtualAllocEx 5524 4041a5 5523->5524 5525 40428c 5523->5525 5526 404020 2 API calls 5524->5526 5525->5509 5527 4041b4 5526->5527 5528 404270 VirtualFreeEx 5527->5528 5531 404241 WriteProcessMemory 5527->5531 5528->5525 5529 404286 5528->5529 5542 4037f0 GetProcessHeap HeapFree 5529->5542 5531->5528 5532 404259 5531->5532 5532->5528 5533 40425e 5532->5533 5541 4037f0 GetProcessHeap HeapFree 5533->5541 5535 404264 5535->5509 5536->5515 5538 404040 5537->5538 5540 404046 5537->5540 5543 403810 GetProcessHeap RtlAllocateHeap 5538->5543 5540->5523 5541->5535 5542->5525 5543->5540 5544->5486

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 00404D00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: NtGetNextProcess$SeDebugPrivilege$d1ff3a37$ntdll.dll
                                                                                                                                                                                                              • API String ID: 0-2867683189
                                                                                                                                                                                                              • Opcode ID: c4a0804236e7788b4098f7f275e0abd03e10ea5118c1f2739568c315aa77eb9b
                                                                                                                                                                                                              • Instruction ID: 5ed088abe51bc9704de4a451be291cc52f30af1fc387e08d9dd35c0f4901fdcf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c4a0804236e7788b4098f7f275e0abd03e10ea5118c1f2739568c315aa77eb9b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B831DBF0A4430476D620BFB69C07BAE3658AF44709F00547BFA84B72D2EEBD564097AD
                                                                                                                                                                                                              Function 00404C20 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,00404E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 00404C32
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00404C3C
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00404C52
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00404C5C
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00404C66
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1673749002-0
                                                                                                                                                                                                              • Opcode ID: f03f0848109c1344e6a2f5cf10159e03204b2a801caeae268af0c0d772a4c6b3
                                                                                                                                                                                                              • Instruction ID: cd08b55a34506c6a1006ed51419cf0447f88819c37ae619cecf6d360b10e5dd7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f03f0848109c1344e6a2f5cf10159e03204b2a801caeae268af0c0d772a4c6b3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF115175A00208ABDB10DBA4DC09FAEBBB8EB4D705F018569FB09E6290DA719E048765
                                                                                                                                                                                                              Function 004042E0 Relevance: 10.6, APIs: 7, Instructions: 131COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 133 4042e0-4042f1 call 4035e0 136 4042f3-4042f8 133->136 137 4042f9-40430e call 4042a0 133->137 140 404310-404317 137->140 141 404318-404321 137->141 142 404323-404338 VirtualAllocEx 141->142 143 40433a-40433f 141->143 142->143 144 40439f-4043ad GetLastError 142->144 145 404341-404354 WriteProcessMemory 143->145 146 40435e-40437c call 404160 143->146 149 4043ba-4043bf 144->149 150 4043af-4043b8 VirtualFreeEx 144->150 145->144 147 404356-40435c 145->147 146->144 154 40437e-40439d CreateRemoteThread 146->154 147->144 147->146 152 4043c1-4043ca VirtualFreeEx 149->152 153 4043cc-4043d4 149->153 150->149 152->153 154->144 155 4043d5-4043e4 call 4037f0 154->155 158 4043f4-404406 CloseHandle 155->158 159 4043e6-4043f3 155->159
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 566e3e481d76894f5171262dd43e3c3fbe6268a2b3aa79397b897dea9fa663b3
                                                                                                                                                                                                              • Instruction ID: 17ae2c20974ab2b3a02811892eedffa6f42bd494a781ace9a9728c4982da2f5b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 566e3e481d76894f5171262dd43e3c3fbe6268a2b3aa79397b897dea9fa663b3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F3186B17002046BD7209F6AEC41F6BB7ACEB84751F14457AFE09E73D0DA75ED0086A8
                                                                                                                                                                                                              Function 0040F2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 160 40f2b0-40f2d1 call 403810 163 40f2d3-40f2da 160->163 164 40f2db-40f305 sprintf CreateFileA 160->164 165 40f375-40f387 call 4037f0 164->165 166 40f307-40f363 memset DeviceIoControl CloseHandle 164->166 166->165 167 40f365-40f36c 166->167 167->165 169 40f36e 167->169 169->165
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00403810: GetProcessHeap.KERNEL32(00000000,00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403819
                                                                                                                                                                                                                • Part of subcall function 00403810: RtlAllocateHeap.NTDLL(00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403820
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040F2E9
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(00000000,00000000,00000003,00000000,00000003,00000000,00000000), ref: 0040F2FA
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F323
                                                                                                                                                                                                              • DeviceIoControl.KERNELBASE(00000000,002D1400,004109A7,0000000C,?,00000400,00000000,00000000), ref: 0040F352
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 0040F35B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateCloseControlCreateDeviceFileHandleProcessmemsetsprintf
                                                                                                                                                                                                              • String ID: \\.\%c:
                                                                                                                                                                                                              • API String ID: 3888047447-1260769427
                                                                                                                                                                                                              • Opcode ID: 1b78f6758d78cf65002979ed1744fd1da693fa348503668dd6cc01d2a8b3a798
                                                                                                                                                                                                              • Instruction ID: 06110f1b05a4b9b3a9b8087ee69a5e127bd0aec849f1c9d495b94b1698777b9d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b78f6758d78cf65002979ed1744fd1da693fa348503668dd6cc01d2a8b3a798
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D42198F19002087BD720DF959C85EFFB77CEB45754F0041BAFA08A6281D6B40F8546A5
                                                                                                                                                                                                              Function 004056E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124nativeCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 202 4056e0-4056ed 203 4056f5-405749 call 402c60 call 402cd0 NtQuerySystemInformation 202->203 204 4056ef-4056f4 202->204 209 405795-40579c 203->209 210 40574b 203->210 212 4057a0-4057a5 209->212 211 405750-405755 210->211 213 405762-405777 call 402cd0 211->213 214 405757-40575c 211->214 215 4057a7-4057b5 212->215 216 4057ed-4057f1 212->216 219 405815-40581c 213->219 228 40577d-405793 NtQuerySystemInformation 213->228 214->213 214->219 221 4057d0-4057da call 404410 215->221 222 4057b7-4057ce 215->222 217 4057f3-4057fd 216->217 218 4057ff-405803 call 402ca0 216->218 217->212 217->218 227 405808-405814 218->227 226 4057df-4057e4 221->226 222->216 222->221 226->216 230 4057e6 226->230 228->209 228->211 230->216
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 00405741
                                                                                                                                                                                                              • NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 0040578B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: InformationQuerySystem
                                                                                                                                                                                                              • String ID: (mA
                                                                                                                                                                                                              • API String ID: 3562636166-412592806
                                                                                                                                                                                                              • Opcode ID: 54551fad4c689b88b6c56286297f79b65224b9cbcfa60a58bb591db8606bca24
                                                                                                                                                                                                              • Instruction ID: cd5f570840ed0612bd24c40dad0ef41f87404906c4f3f406656de7144237ac50
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 54551fad4c689b88b6c56286297f79b65224b9cbcfa60a58bb591db8606bca24
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62418375A00619ABDB10DBA4DD81FBFB3B8EB88704F04456DE905A7380E678ED44DBA4
                                                                                                                                                                                                              Function 00404160 Relevance: 4.6, APIs: 3, Instructions: 122memoryinjectionCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 247 404160-40419f call 404020 VirtualAllocEx 250 4041a5-4041bc call 404020 247->250 251 40428f-404297 247->251 254 404270-404284 VirtualFreeEx 250->254 255 4041c2-4041de call 404100 250->255 254->251 256 404286-40428c call 4037f0 254->256 261 4041e0 255->261 262 40420d-404212 255->262 256->251 263 4041e3-4041e5 261->263 264 404241-404257 WriteProcessMemory 262->264 265 404214 262->265 266 4041e7-404208 call 403640 263->266 267 40420a 263->267 264->254 269 404259-40425c 264->269 268 404217-404219 265->268 266->263 266->267 267->262 271 40421b-40423c call 403640 268->271 272 40423e 268->272 269->254 273 40425e-40426f call 4037f0 269->273 271->268 271->272 272->264
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • VirtualAllocEx.KERNELBASE(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 00404192
                                                                                                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0040424F
                                                                                                                                                                                                              • VirtualFreeEx.KERNEL32(?,00000000,00000000,00008000), ref: 0040427C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Virtual$AllocFreeMemoryProcessWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3247110995-0
                                                                                                                                                                                                              • Opcode ID: 02f7cf14a14e9807913e6e7e1cc57f194bdd3776d6a4df443f608aa8a8b972a6
                                                                                                                                                                                                              • Instruction ID: 66c8841409591aed13a986a2bc30d40898740935292764979a82c35a27653c4f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 02f7cf14a14e9807913e6e7e1cc57f194bdd3776d6a4df443f608aa8a8b972a6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1C31B0F2A00218ABCB20DFA5EC85B6FB768EB84754B05457DFE0977341D634EE048A98
                                                                                                                                                                                                              Function 00403810 Relevance: 3.0, APIs: 2, Instructions: 10memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403819
                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403820
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1357844191-0
                                                                                                                                                                                                              • Opcode ID: baacf28b722c80f1d97f843805acf95dbcbf5d56b1c562bccd72c9ce7d042db9
                                                                                                                                                                                                              • Instruction ID: a45d09a1cc6a3363d10043362d83d70e5a190bee85998ff93397d4509dba2002
                                                                                                                                                                                                              • Opcode Fuzzy Hash: baacf28b722c80f1d97f843805acf95dbcbf5d56b1c562bccd72c9ce7d042db9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B6C09B75144708BBE7005BF4EC0DFD5775CD70C612F408010FB1DC6260C671A4404765
                                                                                                                                                                                                              Function 00410910 Relevance: 52.7, APIs: 22, Strings: 8, Instructions: 172sleepstringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00410930
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 0041093D
                                                                                                                                                                                                              • memset.MSVCRT ref: 0041095D
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00410982
                                                                                                                                                                                                              • ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000,00000005), ref: 004109BF
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
                                                                                                                                                                                                                • Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
                                                                                                                                                                                                                • Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004109CF
                                                                                                                                                                                                              • Sleep.KERNELBASE ref: 00410A05
                                                                                                                                                                                                              • OpenMutexA.KERNEL32 ref: 00410A17
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00410A27
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00410A2E
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00410A32
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 00410A3D
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00410A60
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00410A79
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00410A98
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,0044AFB0,00000208), ref: 00410ACC
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00410ADE
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe,000000FF,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe,00000104,00000000,00000000), ref: 00410B06
                                                                                                                                                                                                              • lstrcpynW.KERNEL32(0044B1B8,00000000,00000208), ref: 00410B13
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,0044B3E0,00000104,00000000,00000000), ref: 00410B2E
                                                                                                                                                                                                              • Sleep.KERNELBASE(000009C4), ref: 00410B59
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00410B70
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$Exitmemset$lstrlen$ByteCharErrorFileLastModuleMultiNameSleepWide_snprintf$CountExecuteHeapMutexOpenShellTick_vsnprintflstrcpynwsprintf
                                                                                                                                                                                                              • String ID: %08x$%s\Microsoft\%s.exe$30e44aa1$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$OPEN$ngrBot$running
                                                                                                                                                                                                              • API String ID: 2173303953-1272996832
                                                                                                                                                                                                              • Opcode ID: 4304e965c2dd2588d97836b17e76e94970c953b8cc78c815aaff85d9230555a5
                                                                                                                                                                                                              • Instruction ID: 4ffe1fa680e8cfeee387428967875dcc16e730cc5b6ba411c3a4c92c7f9556b3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4304e965c2dd2588d97836b17e76e94970c953b8cc78c815aaff85d9230555a5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F51C775E84304BBE710ABB19C0BFDA3A689B54B05F148076F709F61D1DAF856C0876E
                                                                                                                                                                                                              Function 0040B300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 129stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040B312
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 0040B319
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040B339
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040B354
                                                                                                                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000208), ref: 0040B387
                                                                                                                                                                                                              • lstrcpynW.KERNEL32(?,?,00000004), ref: 0040B3A1
                                                                                                                                                                                                              • GetVolumeInformationW.KERNELBASE ref: 0040B3BB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0040B3D8
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0040B3F0
                                                                                                                                                                                                              • lstrcatW.KERNEL32(00000000,.exe), ref: 0040B461
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlenmemset$AllocDirectoryInformationProcessVolumeWindowslstrcatlstrcpyn
                                                                                                                                                                                                              • String ID: .exe$30e44aa1$lol$lol.exe
                                                                                                                                                                                                              • API String ID: 1748614950-52295467
                                                                                                                                                                                                              • Opcode ID: f9e6507004aac15c38e843d6c89bea7e0704aeb0745c849d14503bde2353a770
                                                                                                                                                                                                              • Instruction ID: 8b3afc46e6e6bf4e113eda6340ead4404c7cc4be090bb0c5156ba26052e09737
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f9e6507004aac15c38e843d6c89bea7e0704aeb0745c849d14503bde2353a770
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A41F771601314A6C7208B668C05AEFBBB9EF88311F14C1A7FA18D6191E7B88A50D7AD
                                                                                                                                                                                                              Function 00404AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111synchronizationstringCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strncpy.MSVCRT ref: 00404B1A
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 00404B2C
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00404B3F
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00404B6F
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32 ref: 00404B85
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00404B97
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404BE3
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404C02
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
                                                                                                                                                                                                              • String ID: %s_0$-%sMutex
                                                                                                                                                                                                              • API String ID: 4144850300-892854768
                                                                                                                                                                                                              • Opcode ID: ecddfadb3e7974d3b479c769f3db4150c2fa8099748c697d7ff10cc592852ed6
                                                                                                                                                                                                              • Instruction ID: f71ab11216f24301a232ac9e3dee7d330e97c1bd754f36d27f0bed8dafa8c0fd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ecddfadb3e7974d3b479c769f3db4150c2fa8099748c697d7ff10cc592852ed6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54313AF16003046BD710AF659C81FDBB7AC9F84714F04857BFF48A72D0EAB5E9848698
                                                                                                                                                                                                              Function 00404560 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 171 404560-404578 172 404586-40459f 171->172 173 40457a-404583 171->173 174 4045a0-4045a6 172->174 173->172 175 4046ca-4046e3 174->175 176 4045ac-4045b3 call 404470 174->176 178 404732-4047b1 call 4035f0 175->178 179 4046e5-4046f7 175->179 176->175 184 4045b9-4045e6 _snprintf 176->184 179->174 180 4046fd-404705 179->180 185 4045e8 184->185 186 4045ed-40461b CreateFileMappingA 184->186 185->186 186->180 187 404621-40465a MapViewOfFile 186->187 188 404660-4046c7 call 4035f0 187->188 189 404706-404731 CloseHandle 187->189 188->175
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 004045D5
                                                                                                                                                                                                              • CreateFileMappingA.KERNEL32 ref: 004045FD
                                                                                                                                                                                                              • MapViewOfFile.KERNELBASE(?,000F001F,00000000,00000000,00000000,?,?,00010000,EDB88320,00000000), ref: 00404636
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateMappingView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 1261873476-1933919280
                                                                                                                                                                                                              • Opcode ID: 6e13bc5d45006f82416d3cdcea8d38f2c487028171e142ebaa6c825697568e61
                                                                                                                                                                                                              • Instruction ID: 2d1e0240a6dfd40e8f44cae7654bdf04abfd26f7ecc1aa1406215c6cd6b15d06
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e13bc5d45006f82416d3cdcea8d38f2c487028171e142ebaa6c825697568e61
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D761D1B16002029BD325CF18C881BB6B7E5FF84304F28857DE7869B3C5D779A9A0DB84
                                                                                                                                                                                                              Function 00404470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 192 404470-404488 193 404544-40455b 192->193 194 40448e-4044e0 _snprintf OpenFileMappingA 192->194 195 404530-404535 194->195 196 4044e2-404514 MapViewOfFile 194->196 197 404536-40453d 196->197 198 404516-404528 CloseHandle 196->198 197->193 198->195
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 004044A7
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32 ref: 004044BD
                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 004044F0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0040451B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseHandleMappingOpenView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 460513966-1933919280
                                                                                                                                                                                                              • Opcode ID: 61360a09ed2803673541f69b6359b1b42ff6b64d8add12aeef0c8aaee9439e27
                                                                                                                                                                                                              • Instruction ID: 26658a841a1a3fe0c79036ba11ef289e621c3937bfc9ce10cfabfd1764c09018
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 61360a09ed2803673541f69b6359b1b42ff6b64d8add12aeef0c8aaee9439e27
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D421CFB26507069BD332CF08DC89BB2B3E8EB84304F40857DA74297685DB7DB8609B44
                                                                                                                                                                                                              Function 004068B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 199 4068b0-4068c3 SHGetSpecialFolderPathW 200 4068c5 199->200 201 4068c6-4068db PathAppendW 199->201
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,C:\Program Files (x86)\Internet Explorer\iexplore.exe,00000026,00000001), ref: 004068BB
                                                                                                                                                                                                              • PathAppendW.SHLWAPI(C:\Program Files (x86)\Internet Explorer\iexplore.exe,Internet Explorer\iexplore.exe), ref: 004068D0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Path$AppendFolderSpecial
                                                                                                                                                                                                              • String ID: C:\Program Files (x86)\Internet Explorer\iexplore.exe$Internet Explorer\iexplore.exe
                                                                                                                                                                                                              • API String ID: 2921508639-1997279164
                                                                                                                                                                                                              • Opcode ID: a335c27866ef2bae4a09bd65796f17ffb87ef9b2b152ac25fa9b155a7e5f3500
                                                                                                                                                                                                              • Instruction ID: 5cef3b0c70042a609627615c00b92cc7df0f9fd812bc402db1849e33514db50e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a335c27866ef2bae4a09bd65796f17ffb87ef9b2b152ac25fa9b155a7e5f3500
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1C0C9253D030026E61057144D8ABC22241A774B42FA081A2B202A41E0D3ED4881200E
                                                                                                                                                                                                              Function 00403F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 231 403f90-403f9d 232 403fab-403fb6 call 4035e0 231->232 233 403f9f-403fa6 call 403890 231->233 238 404018-40401b 232->238 239 403fb8-404001 call 4035e0 call 403890 call 403750 232->239 233->232 239->238 246 404003-404012 GetNativeSystemInfo 239->246 246->238
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetNativeSystemInfo.KERNEL32(?,00000000,kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,00404D5C), ref: 00404007
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: InfoNativeSystem
                                                                                                                                                                                                              • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                                                              • API String ID: 1721193555-192647395
                                                                                                                                                                                                              • Opcode ID: 7e7b4dbe53be81b1ab4fbd66654e37c01d7587515854f1dbf4a1af964dd22a61
                                                                                                                                                                                                              • Instruction ID: 791685a111bc0c6a63c3f367ca410b207a7afd2459317f5c88c0cf7fc5170385
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7e7b4dbe53be81b1ab4fbd66654e37c01d7587515854f1dbf4a1af964dd22a61
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AD01D7F1C083099ADB18EFAAA94129E7AF8AB48305F14947FA108B27A0D7795740CB5D
                                                                                                                                                                                                              Function 00404410 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 279 404410-40441e call 4035e0 282 404420-404423 279->282 283 404424-40443a OpenProcess 279->283 284 404447-404467 call 4042e0 CloseHandle 283->284 285 40443c-404446 GetLastError 283->285
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcess.KERNEL32(0000047A,00000000,00000000,?,?,004057DF,?,00000000,00000000,(mA,?,?,?,?), ref: 00404430
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,004057DF,?,00000000,00000000,(mA,?,?,?,?,?,?,?,?,?,00406010), ref: 0040443C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLastOpenProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 919517065-0
                                                                                                                                                                                                              • Opcode ID: fa21c6a546f7665fcd9ed43f9efed41023edd3376a29bcc8ba8710a23aa8e6cc
                                                                                                                                                                                                              • Instruction ID: 0bc3cb10323a7717dc5adc9e31d89cd4ea32d10fdc1a18813f8fb21e42cac110
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa21c6a546f7665fcd9ed43f9efed41023edd3376a29bcc8ba8710a23aa8e6cc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E2F089766401146BD7106BB5BC05EAB779CDBC4395B044036FB0CD3750D5749900C6A9
                                                                                                                                                                                                              Function 0040A990 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48processCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004068B0: SHGetSpecialFolderPathW.SHELL32(00000000,C:\Program Files (x86)\Internet Explorer\iexplore.exe,00000026,00000001), ref: 004068BB
                                                                                                                                                                                                              • CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 0040A9ED
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFolderPathProcessSpecial
                                                                                                                                                                                                              • String ID: D
                                                                                                                                                                                                              • API String ID: 2112413627-2746444292
                                                                                                                                                                                                              • Opcode ID: 835663ffea5eee61987b87af985e6251e3cfc9ab47c548749ea0a7200375bfe3
                                                                                                                                                                                                              • Instruction ID: 2230c3a86171d276420a58e3022d5c119255fdd01a2dfc7308d6bdfabee464bf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 835663ffea5eee61987b87af985e6251e3cfc9ab47c548749ea0a7200375bfe3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5501A272A4031876EB20DAD58C02FEF7B2C9B04B14F14415AFB097B1C5EAB969548399
                                                                                                                                                                                                              Function 00406850 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,C:\Users\user\AppData\Roaming,0000001A,00000001), ref: 0040685B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FolderPathSpecial
                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Roaming
                                                                                                                                                                                                              • API String ID: 994120019-2707566632
                                                                                                                                                                                                              • Opcode ID: 719606b9710c54ecf9254484d1c63c70ec4c7ebb7d3140fe275e23f379cb05b4
                                                                                                                                                                                                              • Instruction ID: dec42c56a20302e498460b79d113f6e88d44876573d08d8c81d581d4537f89bd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 719606b9710c54ecf9254484d1c63c70ec4c7ebb7d3140fe275e23f379cb05b4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3BB092313F434521FA101A788C07FC121486325F03F9082617282F80E0C2DC8D80A20B
                                                                                                                                                                                                              Function 00403830 Relevance: 2.5, APIs: 2, Instructions: 20memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00402D43,?,00000100,?,(mA,?,?,00405730,?,00008000,?,00000000), ref: 0040384F
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(00000000,?,00402D43,?,00000100,?,(mA,?,?,00405730,?,00008000,?,00000000,00000000,?), ref: 00403856
                                                                                                                                                                                                                • Part of subcall function 00403810: GetProcessHeap.KERNEL32(00000000,00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403819
                                                                                                                                                                                                                • Part of subcall function 00403810: RtlAllocateHeap.NTDLL(00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403820
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Process$AllocAllocate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1154092256-0
                                                                                                                                                                                                              • Opcode ID: 6bd858bd068ee9d502431d5df6c01d659be59e0546fa1d939306a6d2d7cd13d1
                                                                                                                                                                                                              • Instruction ID: 59b5348fdb67c635b3c04655c960773e447a90c549b0dc0aa948b3716d5f6312
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6bd858bd068ee9d502431d5df6c01d659be59e0546fa1d939306a6d2d7cd13d1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 20D05BB65002087BEF00AFE4FC49EAA3B9CDB48615F44C065FB0DC7650D635E9008755
                                                                                                                                                                                                              Function 004037F0 Relevance: 2.5, APIs: 2, Instructions: 10memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,0040428C,?,0040428C,00000000), ref: 004037F9
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,?,0040428C), ref: 00403800
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3859560861-0
                                                                                                                                                                                                              • Opcode ID: 38296f158267b1ebc2d54f92307be93bf0282fd4a93306e7a804a0f77be8d180
                                                                                                                                                                                                              • Instruction ID: 9b6b654b7b719752d2f106a16efdcbfd3e8252ceaa65f6ec648e1aaeb866a5ce
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 38296f158267b1ebc2d54f92307be93bf0282fd4a93306e7a804a0f77be8d180
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7DC09B7514430CBBDB005BE4EC0DFD5775CE70C641F40C010F70DC6160C671A4004765
                                                                                                                                                                                                              Function 004030C0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RtlInitializeCriticalSection.NTDLL(EDB8830C,00010000,EDB88320), ref: 004030EB
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalInitializeSection
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 32694325-0
                                                                                                                                                                                                              • Opcode ID: 1ec5181adca8729c0b4d054fe9820a29ef9486c1db9cb2112205f76210c3a441
                                                                                                                                                                                                              • Instruction ID: f882fd944f5205b9f6397f97525e7b153576b9ce51f1a3dc64d4837ac45731b1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ec5181adca8729c0b4d054fe9820a29ef9486c1db9cb2112205f76210c3a441
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88E04F31501725ABDB205F189C02B8B7B9CAF04751F044036FD08A7782E774EA0047D8
                                                                                                                                                                                                              Function 004042A0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • IsWow64Process.KERNELBASE(00000000,00000000,?,?,00404309,00000000,00000000,00000000,00000000), ref: 004042B5
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProcessWow64
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2092917072-0
                                                                                                                                                                                                              • Opcode ID: 22b2903508e7e7fa1c50625dbd83016fe9164760df05acc8bbb1288eadc8f59e
                                                                                                                                                                                                              • Instruction ID: 2da779ddd16944dc38780d38c887f2d19e27236ab7e8ad125095d7b4c023789d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 22b2903508e7e7fa1c50625dbd83016fe9164760df05acc8bbb1288eadc8f59e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5AE08CB072021CABDB30CB90DC04BAA73ACD740349F0002FEBE0892690E63ADE44CB94

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 0040B480 Relevance: 68.6, APIs: 28, Strings: 11, Instructions: 363memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040B4A2
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
                                                                                                                                                                                                                • Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
                                                                                                                                                                                                                • Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00411335), ref: 0040B51A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000104), ref: 0040B536
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 0040B550
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,ERR), ref: 0040B5F5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000104), ref: 0040B60D
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040B641
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040B650
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004), ref: 0040B65F
                                                                                                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0040B67D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(-00000004,00412BE4), ref: 0040B6A8
                                                                                                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0040B6C5
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000000), ref: 0040B719
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000104), ref: 0040B74A
                                                                                                                                                                                                                • Part of subcall function 00401BA0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00401BC5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000104), ref: 0040B75B
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000104), ref: 0040B76E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000104), ref: 0040B781
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B796
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B7AB
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00412C0C), ref: 0040B7CD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B7FC
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B863
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B878
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00412C0C), ref: 0040B89A
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B8C9
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040B8E0
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040B8F3
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$AllocHeap$lstrcpy$lstrlen$memset$InfoLocaleTime$??3@FileSystemVersion_vsnprintflstrcmpstrstr
                                                                                                                                                                                                              • String ID: 2K3$2K8$<br>$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$ERR$VIS$[%s{%s%s{%s$admin$http://api.wipmania.com/$isadmin$n%s[%s{%s%s{%s
                                                                                                                                                                                                              • API String ID: 124843797-830694967
                                                                                                                                                                                                              • Opcode ID: 21b1a8fc1d7472fdfa28336896a60d1f1f0077d824e427616b1b759c51c0f3df
                                                                                                                                                                                                              • Instruction ID: 0949af502ffcd9305bdd3bfb05b668ef187342c133c2638009f109ee02911516
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21b1a8fc1d7472fdfa28336896a60d1f1f0077d824e427616b1b759c51c0f3df
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6CC161B1A44305BBD724DF51CC81FA77378EB44708F10896EF246A62D0E7B8E9848B9D
                                                                                                                                                                                                              Function 00401EA0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 195fileencryptionCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00401ECD
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00401EDA
                                                                                                                                                                                                              • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00401EF5
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00401EFF
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00401F06
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$AcquireCloseContextCreateCryptFileHandle
                                                                                                                                                                                                              • String ID: 0123456789ABCDEF
                                                                                                                                                                                                              • API String ID: 2213256293-2554083253
                                                                                                                                                                                                              • Opcode ID: e4a31331d112a67bdcebc61a7cb6164f8bfe0d5aecb2f3aaefa7239b3fa62299
                                                                                                                                                                                                              • Instruction ID: 29da55e24c53a6960bedebd6ee296a713d47ef44fcd8d90534e508c4660d2c9c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4a31331d112a67bdcebc61a7cb6164f8bfe0d5aecb2f3aaefa7239b3fa62299
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B4517F76A00108BFDB109BE4EC88AFFBB7CEB49355F10856AFB05D2260D77589418B68
                                                                                                                                                                                                              Function 004053D0 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 258nativeinjectionmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 004053E7
                                                                                                                                                                                                              • OpenProcess.KERNEL32(0000047A,00000000,?), ref: 0040540E
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,0000001B,?,00000400,00000000), ref: 0040542F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 004056C0
                                                                                                                                                                                                                • Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
                                                                                                                                                                                                                • Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 004054AB
                                                                                                                                                                                                              • VirtualAllocEx.KERNEL32(00000000,00000000,00400000,00003000,00000040), ref: 0040552F
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 0040554E
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 00405573
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 004055A0
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 004055C4
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 004055EC
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 00405618
                                                                                                                                                                                                                • Part of subcall function 00404160: VirtualAllocEx.KERNELBASE(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 00404192
                                                                                                                                                                                                                • Part of subcall function 00404160: WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0040424F
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 004056B7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$Memory$Read$InformationQueryWrite$AllocVirtual$CloseCompareExchangeHandleInterlockedMutexObjectOpenReleaseSingleThreadWait
                                                                                                                                                                                                              • String ID: STFU$d1ff3a37$zC
                                                                                                                                                                                                              • API String ID: 992379172-3904411787
                                                                                                                                                                                                              • Opcode ID: b939856e6fbf4f50ad2b13fa2647fb61fac06f8d783d1b4027c565cdf868c979
                                                                                                                                                                                                              • Instruction ID: df0844a3ba5e5749fd7180ba75f548f14b80aef18a41645c055a17c66c8f8887
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b939856e6fbf4f50ad2b13fa2647fb61fac06f8d783d1b4027c565cdf868c979
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F79173B5901209AFEB10DF94CC41FEF7778EB88704F10856AE605AB290E7759E41CF68
                                                                                                                                                                                                              Function 0040F130 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122filestringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F150
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F168
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,?), ref: 0040F17B
                                                                                                                                                                                                                • Part of subcall function 0040EDF0: memset.MSVCRT ref: 0040EE0E
                                                                                                                                                                                                                • Part of subcall function 0040EDF0: vsprintf.MSVCRT ref: 0040EE22
                                                                                                                                                                                                                • Part of subcall function 0040EDF0: PathAppendA.SHLWAPI(?,00000000), ref: 0040EE35
                                                                                                                                                                                                              • SetCurrentDirectoryA.KERNEL32(?), ref: 0040F196
                                                                                                                                                                                                              • FindFirstFileA.KERNEL32(?,?), ref: 0040F1AA
                                                                                                                                                                                                              • CoInitialize.OLE32(00000000), ref: 0040F1C2
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040F1E1
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 0040F20C
                                                                                                                                                                                                              • strncmp.MSVCRT ref: 0040F22E
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040F246
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040F26B
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 0040F290
                                                                                                                                                                                                              • FindClose.KERNEL32(?), ref: 0040F29E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Find$Filememset$Next_snprintf$AppendCloseCurrentDirectoryFirstInitializePathlstrcpystrncmpstrstrvsprintf
                                                                                                                                                                                                              • String ID: %s%s$.inf$RECYCLED
                                                                                                                                                                                                              • API String ID: 3870971729-188919753
                                                                                                                                                                                                              • Opcode ID: 60b8cbd9cb59cbd091f6f30096f771bd516400fa658f4aa1f5f2353e77ad20be
                                                                                                                                                                                                              • Instruction ID: 063b9b5624f3e53f2b7c9015ed89a51c60917bf55f536b871253b52f4a03b6c8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60b8cbd9cb59cbd091f6f30096f771bd516400fa658f4aa1f5f2353e77ad20be
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7941A57594021CABCB20DB61DC85FEB777CEB58304F0445AAF908A2190E6B5AFC5CB64
                                                                                                                                                                                                              Function 0040EE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CoCreateInstance.OLE32(00413634,00000000,00000001,00413614,?), ref: 0040EE5B
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040EE81
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0040EE9A
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00412C78), ref: 0040EEAE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0040EEBB
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040EED5
                                                                                                                                                                                                              • SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 0040EEF4
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040EF68
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0040EF7B
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,.lnk), ref: 0040EF89
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0040EFA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
                                                                                                                                                                                                              • String ID: .lnk$shell32.dll
                                                                                                                                                                                                              • API String ID: 3196525290-3399515747
                                                                                                                                                                                                              • Opcode ID: 2290b5e866445997a177ac23c01cd9da2a63de69c1d251cb97f5f0508ae371f8
                                                                                                                                                                                                              • Instruction ID: e73eb6ab999c0e51fafbce32c2bf391fc0f26170288299265a72334d30c84f39
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2290b5e866445997a177ac23c01cd9da2a63de69c1d251cb97f5f0508ae371f8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E513375A40208BFDB50DB94CC85FDAB3B9AF8C704F104599F608E7290D7B4AE85CB64
                                                                                                                                                                                                              Function 00408270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00408292
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004082A8
                                                                                                                                                                                                                • Part of subcall function 004081C0: WSAStartup.WS2_32(00000202,?), ref: 004081E3
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 00408314
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupselect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3882035529-0
                                                                                                                                                                                                              • Opcode ID: 85fd59747fc3b1c661cce8175a3d351750ef0b52ceea1d2a7c6e5893856a6c4a
                                                                                                                                                                                                              • Instruction ID: 4b61705fb868fa9baa08715d210e5fb779858df6dc90d303a1a16509d1b594dd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 85fd59747fc3b1c661cce8175a3d351750ef0b52ceea1d2a7c6e5893856a6c4a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62A1DBB1900604ABC734DF69D981AEBB7E8EF44314F00492FE68D97281E779A9818B95
                                                                                                                                                                                                              Function 00405A20 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 189threadlibraryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LdrEnumerateLoadedModules.NTDLL(00000000,00405040,g\@), ref: 00405B0D
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00405070,00000000,00000000,00000000), ref: 00405C03
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00405C0A
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,004050F0,00000000,00000000,00000000), ref: 00405C3D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00405C44
                                                                                                                                                                                                                • Part of subcall function 00403920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 00403962
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleStringThread$AnsiEnumerateLoadedModulesUnicode
                                                                                                                                                                                                              • String ID: LdrLoadDll$NtResumeThread$d1ff3a37$g\@$g\@$ntdll.dll
                                                                                                                                                                                                              • API String ID: 1691487058-887037736
                                                                                                                                                                                                              • Opcode ID: 15177fe99cea3c95e7436bba47e17e1593aa2991ecdead64e05b4e770913e227
                                                                                                                                                                                                              • Instruction ID: d2a4e14280715d1041b6f2962eb7ad267d111edd4e47b72a6ec2395f63253a1b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15177fe99cea3c95e7436bba47e17e1593aa2991ecdead64e05b4e770913e227
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1619DB5740B02ABDB24DF69CC81F6B73A4EB44704F14453AE941AB7D1D678F9018E98
                                                                                                                                                                                                              Function 00405820 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 171nativesleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00405844
                                                                                                                                                                                                              • NtGetNextProcess.NTDLL(00000000,0000047A,00000000,00000000,00000000), ref: 004058A6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 004058B9
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 004058CF
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,0000001B,00000000,00000800,00000000), ref: 004058FC
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 00405970
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00405A05
                                                                                                                                                                                                                • Part of subcall function 004049F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,004073CC,00437C98,00000000,00000000,00000010,00000000), ref: 00404A10
                                                                                                                                                                                                                • Part of subcall function 004049F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00404A77
                                                                                                                                                                                                              • Sleep.KERNEL32(00000001), ref: 004059F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$CloseHandleInformationQuery$CompareExchangeInterlockedMutexNextObjectReleaseSingleSleepWaitmemset
                                                                                                                                                                                                              • String ID: (mA$.`@$STFU
                                                                                                                                                                                                              • API String ID: 3848293298-61987734
                                                                                                                                                                                                              • Opcode ID: f24b42e263bd2b271f6ef0cc3f2eac0c2c987861a421dc40e64d6442e4c343db
                                                                                                                                                                                                              • Instruction ID: 732b757521710307399e601c09f1fe9508d0a5d5828f33180c83336337d0604a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f24b42e263bd2b271f6ef0cc3f2eac0c2c987861a421dc40e64d6442e4c343db
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4451A3B0A40215ABDB14DFA9CC45BAF77B8EB84710F14817AF945F62C0DB789E40CBA4
                                                                                                                                                                                                              Function 0040E880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84pipestringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040E8A0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0040E8AD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040E8D0
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0040E8FF
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 0040E913
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040E91D
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D7A0,00000000,00000000,00000000), ref: 0040E941
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040E94B
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0040E96E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateNamedPipe$CloseConnectErrorHandleLastThread_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: 30e44aa1$\\.\pipe\%08x_ipc
                                                                                                                                                                                                              • API String ID: 4065143564-1096776489
                                                                                                                                                                                                              • Opcode ID: b3cbc533e10f0eb386fb9391a51dbe8b2d1d24b13574fea3b5d2d9285abe1b33
                                                                                                                                                                                                              • Instruction ID: 85e23c8102626b95d66f369786d20e7ea1e1dc74d471df5540707f019a3fc3e2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3cbc533e10f0eb386fb9391a51dbe8b2d1d24b13574fea3b5d2d9285abe1b33
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 172135B1BC03147AF33063658C47FEA7618AB54F10F248676FB04FA0D0DAF4694446AC
                                                                                                                                                                                                              Function 00409D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129memoryfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000004), ref: 00409DA7
                                                                                                                                                                                                              • CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,20000080,00000000), ref: 00409DD5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocCreateFileVirtual
                                                                                                                                                                                                              • String ID: \\.\PHYSICALDRIVE0
                                                                                                                                                                                                              • API String ID: 1475775534-1557481562
                                                                                                                                                                                                              • Opcode ID: ffcd8f6330cbc774a61a6af0c0f4be1ea2cb921640cac86a5a12dedcfbeb7a29
                                                                                                                                                                                                              • Instruction ID: d500eae6f82fa0b336e9878c8502f6def019f67c4d7c2b81654dcf0d8b160c7b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ffcd8f6330cbc774a61a6af0c0f4be1ea2cb921640cac86a5a12dedcfbeb7a29
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D931B87278030876F62056A9AC46FEB775CD788B32F204262FB08F91D1DAB06D4486F8
                                                                                                                                                                                                              Function 00409EC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00409EDF
                                                                                                                                                                                                              • CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00409F16
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,00090018,00000000,00000000,00000000,00000000,?,00000000), ref: 00409F45
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 00409F5A
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 00409F74
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00409F77
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ControlDeviceFile$CloseCreateHandleWritememset
                                                                                                                                                                                                              • String ID: 00100$U$\\.\PHYSICALDRIVE0
                                                                                                                                                                                                              • API String ID: 3939175881-3482488017
                                                                                                                                                                                                              • Opcode ID: 379a2774db6ed2fe2a0bde7da9e595bf76fda4e7e1670e8e0241eddcfaf8d4ce
                                                                                                                                                                                                              • Instruction ID: c1763296a4acec64689325a2958d955e7f70efc6b3c63e6c8c8dbaef50afdc01
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 379a2774db6ed2fe2a0bde7da9e595bf76fda4e7e1670e8e0241eddcfaf8d4ce
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE11B631BC03187AF730A7649C0BFDAB66C8B59B11F100295F714BA1D1DAE42B4087A9
                                                                                                                                                                                                              Function 00403440 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 136memorynativeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • printf.MSVCRT ref: 004034A0
                                                                                                                                                                                                              • printf.MSVCRT ref: 004034AD
                                                                                                                                                                                                              • printf.MSVCRT ref: 004034CC
                                                                                                                                                                                                              • NtAllocateVirtualMemory.NTDLL(00000000,?,00000000,00437A80,00003000,00000040), ref: 004034F2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: printf$AllocateMemoryVirtual
                                                                                                                                                                                                              • String ID: Done frst$block_size: %d$ngr->blocksize: %d
                                                                                                                                                                                                              • API String ID: 3635587295-1816125109
                                                                                                                                                                                                              • Opcode ID: 97c15441b68f69641c94349759af36be741f732a192bd59ec89c2944423630dc
                                                                                                                                                                                                              • Instruction ID: a515e188e62a96647e9cbe95b5ca16a3a4a6047310d6757b3ddcde311f3628c1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 97c15441b68f69641c94349759af36be741f732a192bd59ec89c2944423630dc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0941F571A00204ABCB14DF59CC45E9A7BADEF84329F14856FF9099B391E638EE41CB94
                                                                                                                                                                                                              Function 0040A550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00403920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 00403962
                                                                                                                                                                                                                • Part of subcall function 00403750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 0040376B
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,ntdll.dll,NtShutdownSystem), ref: 0040A57A
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040A58F
                                                                                                                                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0040A5B3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040A5B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: StringToken$AddressAdjustAnsiErrorLastLookupOpenPrivilegePrivilegesProcedureProcessUnicodeValue
                                                                                                                                                                                                              • String ID: NtShutdownSystem$SeShutdownPrivilege$ntdll.dll
                                                                                                                                                                                                              • API String ID: 4135695518-1699316426
                                                                                                                                                                                                              • Opcode ID: c995f3c1d0a724f36528810c0480acc16cd25410b87a2cccc31b0e10fa1897df
                                                                                                                                                                                                              • Instruction ID: 41268f7d111cdba9b222163e3203631acf71579276c4fa84ae79774109ae6c2c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c995f3c1d0a724f36528810c0480acc16cd25410b87a2cccc31b0e10fa1897df
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EFF08675E403047BD710EBE59D0AFEF7BAC9B08705F104026B604F61D1DAF46A448BA9
                                                                                                                                                                                                              Function 00408C90 Relevance: 4.8, APIs: 3, Instructions: 282COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: memset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2221118986-0
                                                                                                                                                                                                              • Opcode ID: 6a5f6ebefebb7dfedc6c110aece2b1791d9760752105416fcaf749c6c6274392
                                                                                                                                                                                                              • Instruction ID: febdc5ac0e38d1c8f41d274fc77bf47f9808ab6730b1dfa3b6492b89c998bcbc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a5f6ebefebb7dfedc6c110aece2b1791d9760752105416fcaf749c6c6274392
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9A17FB19006059FCB20DF65CA8086FB7B9FF94314B10853FE586E7780DB38E9418B95
                                                                                                                                                                                                              Function 0040F9E0 Relevance: 4.6, APIs: 3, Instructions: 65stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F9FF
                                                                                                                                                                                                              • GetLogicalDriveStringsA.KERNEL32 ref: 0040FA22
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00413040), ref: 0040FA5C
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F459
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F472
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F48B
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F4A4
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F4BD
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F4D6
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F4F2
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F50B
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F526
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F541
                                                                                                                                                                                                                • Part of subcall function 0040F430: memset.MSVCRT ref: 0040F55C
                                                                                                                                                                                                                • Part of subcall function 0040F430: sprintf.MSVCRT ref: 0040F571
                                                                                                                                                                                                                • Part of subcall function 0040F430: sprintf.MSVCRT ref: 0040F586
                                                                                                                                                                                                                • Part of subcall function 0040F430: wsprintfW.USER32 ref: 0040F5A4
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: memset$sprintf$DriveLogicalStringslstrcatwsprintf
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 563256260-0
                                                                                                                                                                                                              • Opcode ID: a9c91dbbf3024f6513c81a224b23af9979e87ef3824b036ee94d37ceb8d413ea
                                                                                                                                                                                                              • Instruction ID: 9caaf356feef068f10e4c180da5a35e979d74dbe615c827e5c843caf9a374edc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a9c91dbbf3024f6513c81a224b23af9979e87ef3824b036ee94d37ceb8d413ea
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE110F75E043496ADB20DB659D41BDB77785F14308F1440BAED48B3182E5B45B0D8765
                                                                                                                                                                                                              Function 00408B30 Relevance: 3.1, APIs: 2, Instructions: 129windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00408B6E
                                                                                                                                                                                                              • EncryptMessage.SECUR32(?,00000000,?,00000000,?,?,?), ref: 00408C29
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EncryptMessagememset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3924230039-0
                                                                                                                                                                                                              • Opcode ID: 18aa0e2ec186b9fd715fd375433968be8474b73af0b85f9de6f245edf6c52d54
                                                                                                                                                                                                              • Instruction ID: 187c4bea0345dcc81a1e91117d9d58187b68109648b59adc59adcf4ae98d03d5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18aa0e2ec186b9fd715fd375433968be8474b73af0b85f9de6f245edf6c52d54
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5D410BB1D01208EFCB50CFA9D981ADEBBF5EF88314F14852EE849E7341D774AA458B94
                                                                                                                                                                                                              Function 00401AD0 Relevance: 1.6, APIs: 1, Instructions: 53timeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00401AE9
                                                                                                                                                                                                                • Part of subcall function 00401A10: CreateFileW.KERNEL32(?,00000100,00000001,00000000,00000003,?,00000000), ref: 00401A36
                                                                                                                                                                                                                • Part of subcall function 00401A10: SetFileTime.KERNEL32(00000000,?,?,?), ref: 00401A50
                                                                                                                                                                                                                • Part of subcall function 00401A10: CloseHandle.KERNEL32(00000000), ref: 00401A59
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileTime$CloseCreateHandleSystem
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 489727163-0
                                                                                                                                                                                                              • Opcode ID: 886a6a8b65339b70eb11e1263818c19f55dc7a13ebdb449e0b673701dd3acba4
                                                                                                                                                                                                              • Instruction ID: c3e60f692382b817dfd982646f5ae67b9cde0dae5d433f1ff3e4d4d48067dd85
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 886a6a8b65339b70eb11e1263818c19f55dc7a13ebdb449e0b673701dd3acba4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BD110CB6D00228BACB10EFD5DC41EEEB77CAB48B04F04895EB715A3185E675A704CB98
                                                                                                                                                                                                              Function 00402D60 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 74ab7da85d1484886710da23cc53855dd25be7a8e112030da8bc2f05dc99f62e
                                                                                                                                                                                                              • Instruction ID: 219b0fc98e8f073de552917feaf8e62aac511575ba6e78677fee7b87815c9be5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 74ab7da85d1484886710da23cc53855dd25be7a8e112030da8bc2f05dc99f62e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA014F322B5D0E49C75E451C1A2CABB12020F56B597D4463A4AC2F07D4EDFEEC43D08D
                                                                                                                                                                                                              Function 0040D7A0 Relevance: 154.5, APIs: 54, Strings: 34, Instructions: 473memorystringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000800), ref: 0040D7C3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000800), ref: 0040D7D2
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040D7EE
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,?,00000000), ref: 0040D80B
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040D819
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040D82F
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040D83C
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040D852
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040D85B
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,00000000,00000800,00000000,00000000), ref: 0040D87A
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 0040D8D3
                                                                                                                                                                                                              • strchr.MSVCRT ref: 0040D8E8
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0040D900
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0040D924
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0040D930
                                                                                                                                                                                                              • strchr.MSVCRT ref: 0040D93F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040D952
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000001,00000000), ref: 0040D95E
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,00000000,00000001), ref: 0040D96D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,ftplog), ref: 0040D97F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFree$ErrorLastlstrcpynlstrlenstrchr$FileReadatoilstrcmpmemset
                                                                                                                                                                                                              • String ID: 0WA$30e44aa1$4WA$8WA$<WA$@WA$FTP -> $POP3 -> $[DNS]: Blocked DNS "%s"$[FTP Infect]: %s was iframed$[FTP Login]: %s$[HTTP Login]: %s$[HTTP Traffic]: %s$[HTTP]: %s$[MSN]: %s$[PDef+]: %s$[POP3 Login]: %s$[Ruskill]: Detected DNS: "%s"$[Ruskill]: Detected File: "%s"$[Ruskill]: Detected Reg: "%s"$blk$block$disable$dns$ftpinfect$ftplog$httplogin$httpspread$httptraff$msn$poplog$rdns$rreg$ruskill
                                                                                                                                                                                                              • API String ID: 1531277263-343948886
                                                                                                                                                                                                              • Opcode ID: 366fe843d4c9f664667192159c464d796e99c310047bf89398e5b99b9f442428
                                                                                                                                                                                                              • Instruction ID: 93a879a63f9d5e1309c0a058911fb680e789185c1f282c53cedf1341369c8508
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 366fe843d4c9f664667192159c464d796e99c310047bf89398e5b99b9f442428
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2E12771A40604BBE71067A59C46FFF762CEF89705F21803AFA15B22D1DBB89D04C6AD
                                                                                                                                                                                                              Function 00410430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 00410446
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000001), ref: 0041044C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 00410453
                                                                                                                                                                                                              • memset.MSVCRT ref: 0041048B
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 00410493
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 004104A9
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 004104C5
                                                                                                                                                                                                              • strstr.MSVCRT ref: 004104DC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00402780), ref: 004104F0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 004104FA
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 00410505
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0041051B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00411335), ref: 00410534
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 00410557
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00402780), ref: 00410567
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0041057B
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 00410596
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 004105A7
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 004105F1
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00412B84), ref: 004105F9
                                                                                                                                                                                                              • strtok.MSVCRT ref: 00410602
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 0041061C
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 00410624
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00402780), ref: 0041062B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0041062E
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00410646
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0041064F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0041065A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000040), ref: 00410667
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00410688
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 004106A0
                                                                                                                                                                                                              • strstr.MSVCRT ref: 004106B7
                                                                                                                                                                                                              • strstr.MSVCRT ref: 004106D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 004106E6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 004106F3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 004106FF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00410714
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 00410721
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,-00000002,?), ref: 0041072C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00410736
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00402780), ref: 0041073E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 0041074B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00402780), ref: 00410761
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00402780), ref: 0041076A
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00410787
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0041079F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 004107AC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 004107B6
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
                                                                                                                                                                                                              • API String ID: 375969099-2909086048
                                                                                                                                                                                                              • Opcode ID: 296e7faadfc0ae5977a3cd50c32995a0c350cb593e103310a6dfe38b1e55d39c
                                                                                                                                                                                                              • Instruction ID: f5f8fd790bcaf9c40db7213d0d9bd0d66c8d2255c156342998f8a5311ef5fb81
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 296e7faadfc0ae5977a3cd50c32995a0c350cb593e103310a6dfe38b1e55d39c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FCA158B1A40309BBDB10DBA58D85EFF777DEB48704F14455AFA14E3241DAB8DE808B68
                                                                                                                                                                                                              Function 0040F430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431filestringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F459
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F472
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F48B
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F4A4
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F4BD
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F4D6
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F4F2
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F50B
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F526
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F541
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040F55C
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040F571
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040F586
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 0040F5A4
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040F5BC
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040F5D3
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040F5EC
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 0040F607
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 0040F61B
                                                                                                                                                                                                                • Part of subcall function 00401CF0: GetFileAttributesW.KERNEL32(?), ref: 00401CF7
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,ERR), ref: 0040F64B
                                                                                                                                                                                                              • _stricmp.MSVCRT(0044A920,00000000), ref: 0040F65D
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0040F684
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0040F692
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0040F6A0
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 0040F6AA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040F6B4
                                                                                                                                                                                                              • CopyFileW.KERNEL32 ref: 0040F6CE
                                                                                                                                                                                                              • lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 0040F6DE
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F747
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,0000412F), ref: 0040F7DA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,?), ref: 0040F7EE
                                                                                                                                                                                                                • Part of subcall function 00401EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00401ECD
                                                                                                                                                                                                                • Part of subcall function 00401EA0: GetLastError.KERNEL32 ref: 00401EDA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,00412B84), ref: 0040F800
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 0040F813
                                                                                                                                                                                                              • lstrlenA.KERNEL32(0000412F,?,00000000), ref: 0040F828
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,0000412F,00000000), ref: 0040F837
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 0040F87C
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F88B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040F8B1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 0040F8C4
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 0040F901
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 0040F93A
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040F97D
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0040F984
                                                                                                                                                                                                              • LockFile.KERNEL32 ref: 0040F98D
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040F9BE
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0040F9C5
                                                                                                                                                                                                              • LockFile.KERNEL32 ref: 0040F9CE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
                                                                                                                                                                                                              • String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
                                                                                                                                                                                                              • API String ID: 2867265384-3663527224
                                                                                                                                                                                                              • Opcode ID: 08fb1b7c711ac0f96f38e0590081cfc46f1ce0d388b703cfdd80850ffa86c36e
                                                                                                                                                                                                              • Instruction ID: 20836134fac00eae2ec925ea06fa7d357da684dde9e8a3904e95b43267198c2c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 08fb1b7c711ac0f96f38e0590081cfc46f1ce0d388b703cfdd80850ffa86c36e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2BE195B1950218BAD730DB61CC45FEB777CEB48704F0045BAF609A2591D7B8ABC4CBA9
                                                                                                                                                                                                              Function 0040E9F0 Relevance: 79.0, APIs: 31, Strings: 14, Instructions: 271stringfilethreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040EA0F
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(ws2_32.dll), ref: 0040EA22
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(secur32.dll), ref: 0040EA29
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(wininet.dll), ref: 0040EA30
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,004157AC), ref: 0040EA3B
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040EA44
                                                                                                                                                                                                                • Part of subcall function 00407330: memset.MSVCRT ref: 00407351
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
                                                                                                                                                                                                                • Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
                                                                                                                                                                                                                • Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2
                                                                                                                                                                                                              • CopyFileW.KERNEL32 ref: 0040EACF
                                                                                                                                                                                                                • Part of subcall function 0040D6B0: RegSetValueExW.ADVAPI32 ref: 0040D731
                                                                                                                                                                                                                • Part of subcall function 0040D6B0: RegCloseKey.ADVAPI32(?), ref: 0040D740
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0040EAFC
                                                                                                                                                                                                                • Part of subcall function 00401AD0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00401AE9
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(0044AFB0), ref: 0040EB2F
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0040EB3A
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(0044AFB0), ref: 0040EB41
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044A920,ERR), ref: 0040EB61
                                                                                                                                                                                                              • lstrlenA.KERNEL32(004157C0), ref: 0040EB72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(004157C0), ref: 0040EBB5
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040EBDE
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040EC15
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(0044B3C8), ref: 0040EC32
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040EC5F
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 0040EC75
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(?), ref: 0040EC95
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040EC97
                                                                                                                                                                                                                • Part of subcall function 00401CF0: GetFileAttributesW.KERNEL32(?), ref: 00401CF7
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E880,00000000,00000000,00000000), ref: 0040ECB2
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040ECBB
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040E990,00000000,00000000,00000000), ref: 0040ECCC
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040ECCF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(0044B3E0), ref: 0040ED26
                                                                                                                                                                                                              • lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe,?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000), ref: 0040ED5E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E770,0044B990,00000000,00000000), ref: 0040ED83
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040ED86
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040FC90,00000000,00000000,00000000), ref: 0040EDA1
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040EDA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$File$CloseCreate$HandleThread$DeleteLibraryLoadmemset$SleepTime_snprintf$AttributesCopyCriticalErrorInitializeLastMutexObjectSectionSingleSystemValueWait_vsnprintflstrcpywsprintf
                                                                                                                                                                                                              • String ID: %s:Zone.Identifier$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$ERR$IPC_Check$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$msnint$msnmsg$ngrBot$running$secur32.dll$wininet.dll$ws2_32.dll
                                                                                                                                                                                                              • API String ID: 4164503275-2703253932
                                                                                                                                                                                                              • Opcode ID: 444f43b11d2a624c663b156b1e2aedc79bdddb40387d3fa837289353c2f94a99
                                                                                                                                                                                                              • Instruction ID: 291cbe2c5dc0da0963d39d682a8af24ece4c38724fc749192e7a20bc4a0e5367
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 444f43b11d2a624c663b156b1e2aedc79bdddb40387d3fa837289353c2f94a99
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 058129B5BC031476F620B7625D47F9B36189B44F04F244437FB04B52D2DAFCA6A08AAE
                                                                                                                                                                                                              Function 0040E130 Relevance: 61.5, APIs: 24, Strings: 11, Instructions: 255sleepstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0044B3C8), ref: 0040E14B
                                                                                                                                                                                                                • Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A013
                                                                                                                                                                                                                • Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A04F
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040E17E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040E18B
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040E198
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040E1A5
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0040E1C8
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0040E22B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040E24D
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 0040E259
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe,0000000B), ref: 0040E292
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe,00000004), ref: 0040E2A4
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044A920,00000000), ref: 0040E2C0
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,00412C7C), ref: 0040E2D3
                                                                                                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 0040E2FA
                                                                                                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 0040E30A
                                                                                                                                                                                                                • Part of subcall function 0040BA00: memset.MSVCRT ref: 0040BA1E
                                                                                                                                                                                                                • Part of subcall function 0040BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0040BA42
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(00000000), ref: 0040E43A
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040E45D
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040E46B
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044B3C8), ref: 0040E478
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0040E3D1
                                                                                                                                                                                                              • [d='%s"] Error getting application data path [e="%d"], xrefs: 0040E3F4
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s), xrefs: 0040E359
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d, xrefs: 0040E41C
                                                                                                                                                                                                              • rebooting, xrefs: 0040E2DE
                                                                                                                                                                                                              • [d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0040E383, 0040E3AE
                                                                                                                                                                                                              • bsod, xrefs: 0040E312
                                                                                                                                                                                                              • [d="%s"] Error downloading file [e="%d"], xrefs: 0040E405
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0040E36E
                                                                                                                                                                                                              • QUIT :%s, xrefs: 0040E2E3
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 0040E279, 0040E28C, 0040E29E, 0040E3A8, 0040E415
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLastSleep$File$CriticalMoveSectionstrtok$??3@DeleteEnterFreeHeapLeave_memicmplstrcmplstrcpylstrlenmemsetwvsprintf
                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$QUIT :%s$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$bsod$rebooting
                                                                                                                                                                                                              • API String ID: 4206007775-3391976417
                                                                                                                                                                                                              • Opcode ID: 8383eb135d202b3d787de8f53a1fe34e0e97aac98dfb618f54b5d29d449e51f8
                                                                                                                                                                                                              • Instruction ID: bdb515e0d9e3ba4769888a699288c0d0595d26c5ffdf0716fbe6c9d3270b13c6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8383eb135d202b3d787de8f53a1fe34e0e97aac98dfb618f54b5d29d449e51f8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9381A9B0A40304BBE7109BA6DC45FAF7778EF44704B20893BFA51B22D1D67899508A6E
                                                                                                                                                                                                              Function 0040DDB0 Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 281sleepstringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0044B3C8), ref: 0040DDCF
                                                                                                                                                                                                                • Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A013
                                                                                                                                                                                                                • Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A04F
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040DDF4
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040DE11
                                                                                                                                                                                                              • toupper.MSVCRT ref: 0040DE28
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040DE68
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040DE71
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040DE7A
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040DE83
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0040DEA8
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0040DF16
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,00000000), ref: 0040DF3D
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 0040DF6A
                                                                                                                                                                                                              • GetLastError.KERNEL32([d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"],?,?,?,00000000), ref: 0040E021
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040E059
                                                                                                                                                                                                              • GetLastError.KERNEL32([d="%s" s="%d bytes"] Error creating process "%S" [e="%d"],?,?,?,00000000), ref: 0040E037
                                                                                                                                                                                                                • Part of subcall function 0040BA00: memset.MSVCRT ref: 0040BA1E
                                                                                                                                                                                                                • Part of subcall function 0040BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0040BA42
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040E0DD
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040E0EB
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044B3C8), ref: 0040E0F8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • dlds, xrefs: 0040DE44, 0040DFA6
                                                                                                                                                                                                              • [d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0040E060
                                                                                                                                                                                                              • [d='%s"] Error getting application data path [e="%d"], xrefs: 0040E080
                                                                                                                                                                                                              • exe, xrefs: 0040DEE4
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d, xrefs: 0040E0A5
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s), xrefs: 0040DFFE
                                                                                                                                                                                                              • [d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0040E042
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Error creating process "%S" [e="%d"], xrefs: 0040E030
                                                                                                                                                                                                              • [d="%s"] Error downloading file [e="%d"], xrefs: 0040E08E
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0040E017
                                                                                                                                                                                                              • ERR, xrefs: 0040DFEC
                                                                                                                                                                                                              • http://, xrefs: 0040DDEE
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$Sleep$CriticalSectionstrtok$??3@EnterFreeHeapLeave_stricmplstrlenmemsetstrstrtoupperwvsprintf
                                                                                                                                                                                                              • String ID: ERR$[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]$[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$dlds$exe$http://
                                                                                                                                                                                                              • API String ID: 3190375853-4059846736
                                                                                                                                                                                                              • Opcode ID: 7b415f29199345d51a7c1c2261afff3371a68d1ab5621527a6eeac73e06a7362
                                                                                                                                                                                                              • Instruction ID: 3e91a635f220bf852c08f817978a574d76a59c4a97b8cc3da9307b122ab73dc0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7b415f29199345d51a7c1c2261afff3371a68d1ab5621527a6eeac73e06a7362
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0591B3B5E00205ABD710DBD5CC85ABFB3B8EB94704F20843AE905B72C5D778E945C6AE
                                                                                                                                                                                                              Function 00407870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00407898
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 0040795D
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040797B
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 004079B7
                                                                                                                                                                                                              • lstrlenA.KERNEL32(0044A2B0,?,00000000,?), ref: 00407A5A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(0044A4B0), ref: 00407A69
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00407AD9
                                                                                                                                                                                                              • _stricmp.MSVCRT(0044A2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,0044A2B0,0044A4B0,00000000,00000000), ref: 00407AE8
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00407B66
                                                                                                                                                                                                                • Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
                                                                                                                                                                                                                • Part of subcall function 00402460: HeapAlloc.KERNEL32(00600000,00000008,004020DE,?,004020DE,?), ref: 0040247E
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044A2B0,00411335,?,00000000,?), ref: 00407BBC
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044A4B0,00411335), ref: 00407BC8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
                                                                                                                                                                                                              • String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
                                                                                                                                                                                                              • API String ID: 389836911-2374598668
                                                                                                                                                                                                              • Opcode ID: 73011210e0d4a48e8bdba20ddd4bd09f13e57796656c983d6342dddc6d99286d
                                                                                                                                                                                                              • Instruction ID: 4ec03147278e1debc2a34b89434d2914110906d41f31d0f6576211e9510b2703
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 73011210e0d4a48e8bdba20ddd4bd09f13e57796656c983d6342dddc6d99286d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D811B70F883556AFB20EF648C49FAF3A645B01708F19447BE904B23D1D6BCB994865F
                                                                                                                                                                                                              Function 0040FE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000,0041037C,?,004132E4,00000000,00000000,httpi), ref: 0040FE11
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FE40
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0040FE47
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FE5E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FE72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FE7C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000002), ref: 0040FE89
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040FEA2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00411335), ref: 0040FEBB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,004119DC), ref: 0040FECD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040FEE4
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 0040FEEF
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0040FF0A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FF14
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0040FF1F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FF33
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00413328), ref: 0040FF4B
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040FF5C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040FF65
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FF6B
                                                                                                                                                                                                              • strncat.MSVCRT ref: 0040FF77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00412B54), ref: 0040FF85
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FF8F
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0040FF9A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040FFAA
                                                                                                                                                                                                                • Part of subcall function 0040FD80: isalnum.MSVCRT ref: 0040FDAC
                                                                                                                                                                                                                • Part of subcall function 0040FD80: strchr.MSVCRT ref: 0040FDBE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 0040FFBE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0040FFCB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0040FFDF
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040FFEC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0041000F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0041001C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0041003C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 423345748-0
                                                                                                                                                                                                              • Opcode ID: ae5a00cf89488068b5b6207a80ca6a947a741f35cae490951e5afd2dcd30bff6
                                                                                                                                                                                                              • Instruction ID: ecdf31bace6aa1cfd498af2b81100673c9cff0bf93b629e0d4807f5436e9076f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae5a00cf89488068b5b6207a80ca6a947a741f35cae490951e5afd2dcd30bff6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75616075A00205BBDB209FA5DC85EFF7B78AF48705F10412AFA04E7390DA78DD8587A8
                                                                                                                                                                                                              Function 004099B0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 205networkstringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 004099D5
                                                                                                                                                                                                              • memset.MSVCRT ref: 004099EF
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000002,?), ref: 00409A00
                                                                                                                                                                                                                • Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
                                                                                                                                                                                                                • Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 00409A28
                                                                                                                                                                                                              • GetTickCount.KERNEL32(00000050,?), ref: 00409A3A
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00409A4D
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000000), ref: 00409A7B
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00409A96
                                                                                                                                                                                                              • connect.WS2_32(?,?,00000010), ref: 00409AB1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 00409ABE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00409AC4
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,X-a: b), ref: 00409AFE
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Connection: Close), ref: 00409B0C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00409B0F
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 00409B41
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000), ref: 00409B51
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00409B5E
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00409B66
                                                                                                                                                                                                              • Sleep.KERNEL32(000009C4), ref: 00409B7F
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 00409BBE
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?,00000000,00000000,00000000), ref: 00409BD2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00409BE4
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 00409C1E
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00409C38
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?,?,00000000,00000000,00000000), ref: 00409C43
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleeplstrlensend$lstrcpymemset$Startupclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
                                                                                                                                                                                                              • String ID: Connection: Close$X-a: b
                                                                                                                                                                                                              • API String ID: 1989272289-3524857483
                                                                                                                                                                                                              • Opcode ID: e55ed3fab58d060f91f269b20baf9e16b0425cfa87e6bee7c3c6f4f2aff97c3a
                                                                                                                                                                                                              • Instruction ID: 7cb26ec54ccc07fb4d2b8a21b45d65960398a2891f86cebd2f8e54a067ade358
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e55ed3fab58d060f91f269b20baf9e16b0425cfa87e6bee7c3c6f4f2aff97c3a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2F713071940254BBD710EBA1DD45FDEB378AB88704F10897AEA09F31D1D674AE81CF98
                                                                                                                                                                                                              Function 0040AFA0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 149stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Alloc_memicmp_snprintfmemsetstrtok$Freelstrcpynsscanf
                                                                                                                                                                                                              • String ID: HTTP$Host: $POST /%1023s$http://%s/$http://%s/%s
                                                                                                                                                                                                              • API String ID: 3179755921-1264106924
                                                                                                                                                                                                              • Opcode ID: 7a85f2fa3f128ae44cfddedb1f709c34d0d92754e0fa6682c9478743df51b5cc
                                                                                                                                                                                                              • Instruction ID: b9d19011a538f4e63f226923da5865426bd74754d0a48babbb538e4dd702a74a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a85f2fa3f128ae44cfddedb1f709c34d0d92754e0fa6682c9478743df51b5cc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 704107B6D8021877D720EB618D42FEB736CDB44750F0444A6FB08F2181E6B89A958BED
                                                                                                                                                                                                              Function 00406A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00406A68
                                                                                                                                                                                                              • lstrlenA.KERNEL32 ref: 00406B03
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 00406B0E
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 00406B22
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 00406B36
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 00406B4F
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 00406B69
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00406BD5
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(0044A710,00000080), ref: 00406C31
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(0044A710,00000000,00000004), ref: 00406C40
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00406C60
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00406C67
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
                                                                                                                                                                                                              • String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
                                                                                                                                                                                                              • API String ID: 1085873876-1467418891
                                                                                                                                                                                                              • Opcode ID: 36f732a5e5157c8bf70980ced940681cdc4e50872ef3035894859d50dcb2493c
                                                                                                                                                                                                              • Instruction ID: 423ddb9557b74d048bf2445d23ea001235c7c8144a5ecbbbaa60eb2ae93ad116
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 36f732a5e5157c8bf70980ced940681cdc4e50872ef3035894859d50dcb2493c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0510A71A402147AEB20AB558C86FDF7378AB44744F15443BFE05B22D1D6BCA9A0C66E
                                                                                                                                                                                                              Function 00410050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00410071
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00410080
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 004100AB
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 004100B6
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 004100CB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 004100D2
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 004100E3
                                                                                                                                                                                                              • strtok.MSVCRT ref: 004100F9
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00410117
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00410129
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00412B84), ref: 00410141
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 0041014E
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 00410160
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00410177
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 0041018A
                                                                                                                                                                                                              • strtok.MSVCRT ref: 00410193
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 004101AB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 004101B2
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 004101BE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
                                                                                                                                                                                                              • String ID: $Content-Length:
                                                                                                                                                                                                              • API String ID: 4006885983-3599722475
                                                                                                                                                                                                              • Opcode ID: 7ff4a7bd8c94b7bf3eaa9ce5187c864245572b4f44c2c24807b34d1679db51b7
                                                                                                                                                                                                              • Instruction ID: 31871e1923dfa0c5687494671088c66f74ce18a02ae0b8733e53a839020a0827
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ff4a7bd8c94b7bf3eaa9ce5187c864245572b4f44c2c24807b34d1679db51b7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A41F671640308BBDB20AF619C45FEF776C9F58715F04411AFE08A6241E7FD9AC18BA9
                                                                                                                                                                                                              Function 0040A310 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 127stringfilesleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                              • _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040A484
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040A48B
                                                                                                                                                                                                              • Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A496
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A4A1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CriticalSectionmemset$FileLeavesprintf$CloseCreateEnterHandleSleepWrite_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %d.$30e44aa1$\\.\pipe\%08x_ipc
                                                                                                                                                                                                              • API String ID: 4010528547-3602371622
                                                                                                                                                                                                              • Opcode ID: e2aaf14788d83a4ecd39c6f1ebb182ce0fa52ecfe3d62897a226de696ea3b29b
                                                                                                                                                                                                              • Instruction ID: 8e1fe3b8e3d8ffe6930c52ef9346d3acd19d967879cd91ce29727965d539cad2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e2aaf14788d83a4ecd39c6f1ebb182ce0fa52ecfe3d62897a226de696ea3b29b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2B41DBB6680318BBD711E7A1DD46FEA732CDF88705F004495F708E60D1DAF85A848B6D
                                                                                                                                                                                                              Function 0040D220 Relevance: 36.2, APIs: 11, Strings: 13, Instructions: 209stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstrstrtok$lstrcmplstrlen
                                                                                                                                                                                                              • String ID: WA$001$332$376$433$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
                                                                                                                                                                                                              • API String ID: 4048585210-2025634042
                                                                                                                                                                                                              • Opcode ID: b8cde92cb1254a2a7ae024d0b2fa4488480de74b93d1f53c48958e3b38037d86
                                                                                                                                                                                                              • Instruction ID: b43457d1463e33dec7e291493da2b720a1f97c649ceaa871d4bac8b1837a23f4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b8cde92cb1254a2a7ae024d0b2fa4488480de74b93d1f53c48958e3b38037d86
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4651E8B6E4020966D710B669FC42BEA736CDB84719F10817BFC08E2281F67DE85546ED
                                                                                                                                                                                                              Function 004101E0 Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 189memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00410202
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00410213
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0044B4E4), ref: 00410223
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00410243
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00410254
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0041025F
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 00410272
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00410281
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 004102C8
                                                                                                                                                                                                              • strstr.MSVCRT ref: 004102EF
                                                                                                                                                                                                              • atoi.MSVCRT(00000000,?,http,int), ref: 00410322
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00410386
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 004103E4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 004103EE
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044B4E4), ref: 004103FD
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041041F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Freestrstr$CriticalSectionlstrlen$AllocEnterLeaveProcess_snprintfatoilstrcpymemset
                                                                                                                                                                                                              • String ID: $%s.%s hijacked!$%s=$http$httpi$httpspread$int$msg
                                                                                                                                                                                                              • API String ID: 2097228407-1593535274
                                                                                                                                                                                                              • Opcode ID: b42ee02560c5ab2bb11f09cbf2a911d293081bdd1cea416efea083627c59d2d0
                                                                                                                                                                                                              • Instruction ID: 6b613a8a9dd3db62d23416ef6319fd59981c507d6a8595e650e32660f9c914f4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b42ee02560c5ab2bb11f09cbf2a911d293081bdd1cea416efea083627c59d2d0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6851A771A40319ABDB109BA19C85BFFB778EB44704F14443AFD14A2241DAB8ADD08BAD
                                                                                                                                                                                                              Function 0040AE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00407CC2,00000000,00412914,?,?,?,?,?,?), ref: 0040AE11
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000001,?,00407CC2,00000000,00412914,?,?,?,?,?,?,?,00000000), ref: 0040AE23
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 0040AE41
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040AE59
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0040AE70
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0040AE77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00412B54), ref: 0040AE7F
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040AE8E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040AEA1
                                                                                                                                                                                                              • _strnicmp.MSVCRT ref: 0040AEA6
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040AEB9
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040AED5
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040AEEB
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040AF10
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0040AF20
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0040AF27
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040AF2B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0040AF3D
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000001), ref: 0040AF58
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 0040AF5F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 0040AF6B
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040AF82
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040AF91
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3119447416-0
                                                                                                                                                                                                              • Opcode ID: 90aa6b444a65bc303e4c0c8d939ed632e773fc8290ec026285192ba5a7dd26f4
                                                                                                                                                                                                              • Instruction ID: 1bbc8982e5118dc887994d25652db9e03b56cb4a90299a9d625484b85630a4b0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 90aa6b444a65bc303e4c0c8d939ed632e773fc8290ec026285192ba5a7dd26f4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F418F75641314BBD7209F65DC81FAB77A8EF49701F14402AFA04A7390DA78ED128BEA
                                                                                                                                                                                                              Function 00407C00 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 175stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00407C62
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 00407D58
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,WHM), ref: 00407D71
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,WHCMS), ref: 00407D8A
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,Directadmin), ref: 00407DA3
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00407E02
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 00407E12
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
                                                                                                                                                                                                                • Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
                                                                                                                                                                                                                • Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A
                                                                                                                                                                                                                • Part of subcall function 00407330: memset.MSVCRT ref: 00407351
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
                                                                                                                                                                                                                • Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
                                                                                                                                                                                                                • Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
                                                                                                                                                                                                              • String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$4)A$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
                                                                                                                                                                                                              • API String ID: 3716863481-1807948723
                                                                                                                                                                                                              • Opcode ID: 4a736dc5ae38fec02d6e3fdb9bca2a70190721733e72d1171b80fa96087029d3
                                                                                                                                                                                                              • Instruction ID: 7c69c185b85492ea0b4eb43dfbe131e2600de0d92cd53af2a8a27ef6520c0e50
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a736dc5ae38fec02d6e3fdb9bca2a70190721733e72d1171b80fa96087029d3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EC5193B4E04215ABEB10DB95DC42EFB736CAF40704B15443FF905A2282E678FD91C6AE
                                                                                                                                                                                                              Function 004025D0 Relevance: 31.7, APIs: 7, Strings: 14, Instructions: 191stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 0040260F
                                                                                                                                                                                                                • Part of subcall function 004107D0: lstrlenA.KERNEL32(*&@,?,?,00000000,?,0040262A,?,00417008), ref: 004107DC
                                                                                                                                                                                                                • Part of subcall function 004107D0: lstrcpyA.KERNEL32(00000000,*&@,?,00417008), ref: 004107F9
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040264F
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 004026FB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 00402713
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040276B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,00000000), ref: 0040278C
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 004027F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$atoi$FreeHeap_snprintflstrcpymemsetsscanfstrstr
                                                                                                                                                                                                              • String ID: %s.p10-> Message hijacked!$%s.p10-> Message to %s hijacked!$%s.p21-> Message hijacked!$CAL $CAL %d %256s$MSG $MSG $SDG $X-MMS-IM-Format:$baddr$msn$msnint$msnmsg$msnu
                                                                                                                                                                                                              • API String ID: 1527159713-2027340701
                                                                                                                                                                                                              • Opcode ID: 7f94b3709b2fe44f4610c5b915d20a8e271abbfcf2ab1d49b05e8e5479e812bf
                                                                                                                                                                                                              • Instruction ID: cc3cb0c7f7b4e0dd65bdd1dfcfed23b6e80cb0fd4157fe51233a31162f211526
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7f94b3709b2fe44f4610c5b915d20a8e271abbfcf2ab1d49b05e8e5479e812bf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B515775E4020477CB206BA56D86AEF7764AB45714F20847BFD04B33C2E6FD9980869F
                                                                                                                                                                                                              Function 0040EFE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 106stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmp$AttributesFile_snprintfmemsetstrrchr$ExtensionFindPath
                                                                                                                                                                                                              • String ID: %windir%\system32\cmd.exe$&&%%windir%%\explorer.exe %%cd%%%s$.lnk$/c "start %%cd%%RECYCLED\%s$RECYCLED
                                                                                                                                                                                                              • API String ID: 1691573101-2902080580
                                                                                                                                                                                                              • Opcode ID: 5bc81bcee3f252d83d54341abee0ba37cc4b7d257fcd483ce1e4fc9cd7f23c5e
                                                                                                                                                                                                              • Instruction ID: b7277a1c29d753c849b745b8ec094361e978608dab2ca0d9a5f82dce8da3388c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bc81bcee3f252d83d54341abee0ba37cc4b7d257fcd483ce1e4fc9cd7f23c5e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3431C77264431566E730A655DC02FEB726CAF88741F040076FA08B51C2DBFC9D958AB9
                                                                                                                                                                                                              Function 0040E590 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 141stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040E5B0
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0044B3C8), ref: 0040E5C9
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040E5FE
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040E617
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040E62D
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040E642
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040E655
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040E65B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00411335), ref: 0040E678
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0040E687
                                                                                                                                                                                                                • Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 0040752B
                                                                                                                                                                                                                • Part of subcall function 00407500: _snprintf.MSVCRT ref: 00407547
                                                                                                                                                                                                                • Part of subcall function 00407500: _vsnprintf.MSVCRT ref: 00407569
                                                                                                                                                                                                                • Part of subcall function 00407500: lstrcmpA.KERNEL32(?,bdns), ref: 0040758B
                                                                                                                                                                                                                • Part of subcall function 00407500: StrStrIA.SHLWAPI(?,00000000), ref: 0040759F
                                                                                                                                                                                                                • Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 004075B9
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040E6CF
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040E71E
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040E72D
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044B3C8), ref: 0040E73A
                                                                                                                                                                                                                • Part of subcall function 0040AA10: memset.MSVCRT ref: 0040AA31
                                                                                                                                                                                                                • Part of subcall function 0040AA10: lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0040AA45
                                                                                                                                                                                                                • Part of subcall function 0040AA10: InternetOpenA.WININET(00000000,?,?,?,?), ref: 0040AA60
                                                                                                                                                                                                                • Part of subcall function 0040AA10: lstrlenA.KERNEL32(?), ref: 0040AA78
                                                                                                                                                                                                                • Part of subcall function 0040AA10: InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0040AA8C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$strstr$CriticalInternetOpenSectionlstrcpymemsetstrtok$??3@EnterFreeHeapLeave_snprintf_vsnprintflstrcmplstrcpyn
                                                                                                                                                                                                              • String ID: [DNS]: Blocked %d domain(s) - Redirected %d domain(s)$bdns$block
                                                                                                                                                                                                              • API String ID: 1940452476-536441337
                                                                                                                                                                                                              • Opcode ID: e0c3f006f835b63e75a487973050d10b4b484bcd90eee046b06ff0ea6506e5df
                                                                                                                                                                                                              • Instruction ID: 8fc5987a9c18eaf0ca0f86d422a7c70f959c4985efb5a17c84fe55bca5c7fef6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e0c3f006f835b63e75a487973050d10b4b484bcd90eee046b06ff0ea6506e5df
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C3412E71E403087BD710A7A69C42DFF7778DB94304F144867FA04F3291E6BD5A9086A9
                                                                                                                                                                                                              Function 0040AA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040AA31
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0040AA45
                                                                                                                                                                                                              • InternetOpenA.WININET(00000000,?,?,?,?), ref: 0040AA60
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040AA78
                                                                                                                                                                                                              • InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0040AA8C
                                                                                                                                                                                                              • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 0040AAC0
                                                                                                                                                                                                              • InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 0040AAE2
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040AB15
                                                                                                                                                                                                              • InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 0040AB67
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040AB85
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040ABA5
                                                                                                                                                                                                              • InternetCloseHandle.WININET(00000000), ref: 0040ABE7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
                                                                                                                                                                                                              • String ID: Mozilla/4.0
                                                                                                                                                                                                              • API String ID: 2392773942-2634101963
                                                                                                                                                                                                              • Opcode ID: 1b66e0c946156f398ab60e0d83713a33fd972e7ec94f10fe616f795e65287529
                                                                                                                                                                                                              • Instruction ID: a422d9b20280b57269b7f944718ccc37572e3d881d969e5d12542f5013b1ac47
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b66e0c946156f398ab60e0d83713a33fd972e7ec94f10fe616f795e65287529
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA519D75A00205AFD720DF59EC84FAA77F8EB49300F14847EE908E7290D7B4A955CF99
                                                                                                                                                                                                              Function 00402220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00402243
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 00402257
                                                                                                                                                                                                                • Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
                                                                                                                                                                                                                • Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 00402288
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00402297
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 004022AE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004022C3
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004022F4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00402307
                                                                                                                                                                                                              • send.WS2_32(00000000,00000000,00000400,00000000), ref: 00402344
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00402350
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 00402363
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
                                                                                                                                                                                                              • String ID: gfff$i.root-servers.org
                                                                                                                                                                                                              • API String ID: 99835129-3534201491
                                                                                                                                                                                                              • Opcode ID: 317ce54c39d5c71596ee40f80715c5cfa82186658545931fb13a094379eca06e
                                                                                                                                                                                                              • Instruction ID: 99d350245f41469f9620f1c84c2ac9dacd51c4893e9af8f4a97e645d4d05bf82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 317ce54c39d5c71596ee40f80715c5cfa82186658545931fb13a094379eca06e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 20312872B0031857DB14E67A9D46BEFA2698B85714F04457AFE0CE72C0EAF88D81469A
                                                                                                                                                                                                              Function 00409830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00409850
                                                                                                                                                                                                              • strtok.MSVCRT ref: 0040986E
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040988B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 004098A8
                                                                                                                                                                                                              • strtok.MSVCRT ref: 004098B5
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 004098D1
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040999C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [UDP]: Finished flood on "%s:%d", xrefs: 00409970
                                                                                                                                                                                                              • [UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 0040993A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-2644890838
                                                                                                                                                                                                              • Opcode ID: 7302b2c3c8239b7c7e436c02be83916ed6e595abfe8cd86b1936ef3e7f60cb9d
                                                                                                                                                                                                              • Instruction ID: fbb45061dfc7ed30b2521fa6da11e7ac7608b88c8cddc2238a61025220eaa290
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7302b2c3c8239b7c7e436c02be83916ed6e595abfe8cd86b1936ef3e7f60cb9d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A531DCF26442086BD720A7A1AC46FE7375CDB84709F04417EFF08E12D1D5B99D5087AD
                                                                                                                                                                                                              Function 004096B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 004096D0
                                                                                                                                                                                                              • strtok.MSVCRT ref: 004096EE
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040970B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 00409728
                                                                                                                                                                                                              • strtok.MSVCRT ref: 00409735
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 00409751
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040981C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [SYN]: Starting flood on "%s:%d" for %d second(s), xrefs: 004097BA
                                                                                                                                                                                                              • [SYN]: Finished flood on "%s:%d", xrefs: 004097F0
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [SYN]: Finished flood on "%s:%d"$[SYN]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-3475151101
                                                                                                                                                                                                              • Opcode ID: 70168977f209cdc44c3587aeaaa13b5495e3e8976b9f106383a431fdfcd3f3c7
                                                                                                                                                                                                              • Instruction ID: bdd8c48b6cfbaf6ae2aa7db1173a1b009192250db3acf329e7d18af35a504bf2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 70168977f209cdc44c3587aeaaa13b5495e3e8976b9f106383a431fdfcd3f3c7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B631E9F2A50204ABD720A7A1AC46FE7375CDB45309F14847AFF08A22D2D6B89D5087AD
                                                                                                                                                                                                              Function 004012B5 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 108COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Filewcsstr$Attributes$Move
                                                                                                                                                                                                              • String ID: %s.%S$DBWIN$\\.\pipe$brk$dll$exe$ruskill
                                                                                                                                                                                                              • API String ID: 3850124382-1976196219
                                                                                                                                                                                                              • Opcode ID: 3df96f720bcbf06451592073452cd294d664bc86748c20fabd492f92b7040022
                                                                                                                                                                                                              • Instruction ID: ce873ccbf541a133aeb7b44035e56f9fea29af0b52c17374ddf13312e66b33ad
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3df96f720bcbf06451592073452cd294d664bc86748c20fabd492f92b7040022
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A8312370640306ABF7109F519C42FDF32489F14719F14413FFE14A2AE1EB7D998882AE
                                                                                                                                                                                                              Function 004010A0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 102stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 004010C0
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 004010D7
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,0044A710), ref: 0040111D
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00401127
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 00401161
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00416D88,00000000), ref: 00401179
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00411335), ref: 00401187
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 004011A0
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00416E90,00000000), ref: 004011B3
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcpy$ByteCharMultiWidelstrcmpmemset$FileMove_snprintflstrlen
                                                                                                                                                                                                              • String ID: %s.%S$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 1230166232-507188350
                                                                                                                                                                                                              • Opcode ID: 5cee78ce5023d09d431a3963bbf3d578834d416528f4f925de50f2660146731b
                                                                                                                                                                                                              • Instruction ID: 68c4e51678c4734124622e75f1a3a1355b75001ea3a3ec5cf96f04565ba1ff23
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5cee78ce5023d09d431a3963bbf3d578834d416528f4f925de50f2660146731b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6C3106B17403187BE7209B559C82FEB736C9B89B10F104167FB54B62D0D6F4ED80866D
                                                                                                                                                                                                              Function 00410C80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100memorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 00410C89
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,0044AA28,00000104), ref: 00410C9F
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,0044A710,00000208), ref: 00410CB0
                                                                                                                                                                                                              • GetWindowsDirectoryA.KERNEL32(0044AB30,00000104), ref: 00410CC0
                                                                                                                                                                                                                • Part of subcall function 004019F0: wcsrchr.MSVCRT ref: 004019F9
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(0044AC34), ref: 00410CE3
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(0044B4E4), ref: 00410CEA
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(0044A710,00000000,00000004), ref: 00410DA5
                                                                                                                                                                                                                • Part of subcall function 0040A150: memset.MSVCRT ref: 0040A170
                                                                                                                                                                                                                • Part of subcall function 0040A150: GetWindowsDirectoryW.KERNEL32(?,00000208,?,?,00000000), ref: 0040A184
                                                                                                                                                                                                                • Part of subcall function 0040A150: _memicmp.MSVCRT ref: 0040A1C3
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(0044A710,00000080), ref: 00410D96
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E9F0,00000000,00000000,00000000), ref: 00410DED
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00410DF4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CriticalDirectoryInitializeModuleNameSectionWindows$AttributesCloseCreateHandleHeapMoveProcessThread_memicmpmemsetwcsrchr
                                                                                                                                                                                                              • String ID: %s.%S$brk$ruskill
                                                                                                                                                                                                              • API String ID: 2870590860-2269373653
                                                                                                                                                                                                              • Opcode ID: bd43cfd4bc18c6323a9ed54d67b1770024b1bf1a37d339462c6df0a781fe6b3b
                                                                                                                                                                                                              • Instruction ID: 3a2e178202fb7a30b488f4e8e7deeec61a3289b4e305d2c307b23111bd812d03
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd43cfd4bc18c6323a9ed54d67b1770024b1bf1a37d339462c6df0a781fe6b3b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E031B471AC0310B7F3306BA1AD0BFCA76A4A709B05F204037FB01A56E1D6FCA0A1865F
                                                                                                                                                                                                              Function 0040A880 Relevance: 22.6, APIs: 2, Strings: 13, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040A89E
                                                                                                                                                                                                                • Part of subcall function 00407790: memset.MSVCRT ref: 004077AE
                                                                                                                                                                                                                • Part of subcall function 00407790: memset.MSVCRT ref: 004077C8
                                                                                                                                                                                                                • Part of subcall function 00407790: lstrcpyA.KERNEL32(00000000,off), ref: 004077F0
                                                                                                                                                                                                                • Part of subcall function 00407790: _snprintf.MSVCRT ref: 0040780D
                                                                                                                                                                                                                • Part of subcall function 00407790: lstrlenA.KERNEL32(00000000), ref: 00407822
                                                                                                                                                                                                                • Part of subcall function 00407790: lstrlenA.KERNEL32(00000000), ref: 00407858
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040A936
                                                                                                                                                                                                                • Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 0040752B
                                                                                                                                                                                                                • Part of subcall function 00407500: _snprintf.MSVCRT ref: 00407547
                                                                                                                                                                                                                • Part of subcall function 00407500: _vsnprintf.MSVCRT ref: 00407569
                                                                                                                                                                                                                • Part of subcall function 00407500: lstrcmpA.KERNEL32(?,bdns), ref: 0040758B
                                                                                                                                                                                                                • Part of subcall function 00407500: StrStrIA.SHLWAPI(?,00000000), ref: 0040759F
                                                                                                                                                                                                                • Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 004075B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintfmemset$_vsnprintflstrcmplstrcpy
                                                                                                                                                                                                              • String ID: bdns$ffgrab$ftpgrab$http$httpi$iegrab$int$msg$msn$msnu$pdef$popgrab$usbi
                                                                                                                                                                                                              • API String ID: 3955240783-2907616027
                                                                                                                                                                                                              • Opcode ID: 6921b983e77eaeb6a45a57ebef2841d3fb1cf029487e43abea5590fc1fb65a58
                                                                                                                                                                                                              • Instruction ID: 457c04c965f4f402ec546b575a89d7806f30f9b4e57064c7f721fde9d0d55c32
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6921b983e77eaeb6a45a57ebef2841d3fb1cf029487e43abea5590fc1fb65a58
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3211CC74FE930675E660BBA25D83FD962254B40F48F20046B7618BA0D799FD35D0826F
                                                                                                                                                                                                              Function 004017E0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040180E
                                                                                                                                                                                                              • memset.MSVCRT ref: 00401829
                                                                                                                                                                                                              • wcsstr.MSVCRT ref: 00401842
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 00401888
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00401898
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000208), ref: 004018B7
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 00401905
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememset$lstrcmpstrstrwcsstr
                                                                                                                                                                                                              • String ID: %s.%S$bdns$block$brk$rdns
                                                                                                                                                                                                              • API String ID: 695720605-4000218262
                                                                                                                                                                                                              • Opcode ID: 44816ac00eed52af6030ea9bcc38c72550ec5595d76f692227d7bf7902e9d138
                                                                                                                                                                                                              • Instruction ID: 328a3583c6fef178050e9a0b2bf86a627fd064549297ff0a8097fc8f98231c6a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44816ac00eed52af6030ea9bcc38c72550ec5595d76f692227d7bf7902e9d138
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9511CB1A0020877EB20EB55DC46FDB77689B45715F10413BFD14B22E1D7B8DA84C7AA
                                                                                                                                                                                                              Function 004073E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _vsnprintflstrlenmemset$_memicmp_snprintf
                                                                                                                                                                                                              • String ID: %s.%s$%s_$blk$block
                                                                                                                                                                                                              • API String ID: 3657324510-3589362310
                                                                                                                                                                                                              • Opcode ID: 99d4df8564ca8f3e4280b218a1f10db2543056bd08d5aedc47cc3932259c1859
                                                                                                                                                                                                              • Instruction ID: e3d0b4f69a4c5134c0a3218338a603e019a2a9bfe2e8293b1a871985f276413f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99d4df8564ca8f3e4280b218a1f10db2543056bd08d5aedc47cc3932259c1859
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE2132B294031D7AE710EB59DC82FFB336CDB44708F4445BEBB0893182E5789E854769
                                                                                                                                                                                                              Function 00409580 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: memset$lstrcpy$CountTicksprintfstrtok
                                                                                                                                                                                                              • String ID: %s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42$GET$Mozilla/4.0$POST
                                                                                                                                                                                                              • API String ID: 3318893083-109246470
                                                                                                                                                                                                              • Opcode ID: 13909f0f54b35832f884170cda3099b18f4978d60edfb22db4c14337bbf3beee
                                                                                                                                                                                                              • Instruction ID: a58238f94dc203fc7a4291ccda806a9fd0a954f169f11a3db57d908f1604fe94
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 13909f0f54b35832f884170cda3099b18f4978d60edfb22db4c14337bbf3beee
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 06212DF29402186AC714E769CD42FDA736C9BA8704F00459BF308B21C1D6F8AFC48A6C
                                                                                                                                                                                                              Function 00406F70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 125stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00406F91
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,HKCU\), ref: 00406FFE
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000400), ref: 00407017
                                                                                                                                                                                                              • _wcsnicmp.MSVCRT ref: 00407061
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWide_wcsnicmplstrcpymemset
                                                                                                                                                                                                              • String ID: %S%s%s$%s.%s%s$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
                                                                                                                                                                                                              • API String ID: 2911520168-3007424447
                                                                                                                                                                                                              • Opcode ID: e12486c08886b7696a958c741fe560a301e516580bbd543c04c1c056b4c33f5c
                                                                                                                                                                                                              • Instruction ID: 52cdffd3aed9817ff0f5470690bd97fa8b38541f7e8b3e480f67bf3efe9e444e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e12486c08886b7696a958c741fe560a301e516580bbd543c04c1c056b4c33f5c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D241A5B1B54218BBDB10CF95DC42FEF77ACAB58714F10412BFA04F2281E678A9508769
                                                                                                                                                                                                              Function 00406940 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 72stringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004019F0: wcsrchr.MSVCRT ref: 004019F9
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                              • strstr.MSVCRT ref: 004069A8
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00416D88,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe,?,?,?,?,?,?), ref: 004069BE
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(00416E90,00000080,?,?,?,?,?,?), ref: 004069D2
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(00416E90,?,?,?,?,?,?), ref: 004069DD
                                                                                                                                                                                                              • MoveFileExA.KERNEL32 ref: 004069EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 004069B4
                                                                                                                                                                                                              • %s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!, xrefs: 00406A06
                                                                                                                                                                                                              • pdef, xrefs: 00406986
                                                                                                                                                                                                              • %s.Blocked "%S" from creating "%S", xrefs: 00406A24
                                                                                                                                                                                                              • autorun.inf, xrefs: 00406970
                                                                                                                                                                                                              • .exe, xrefs: 0040699C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Filememset$CriticalSection_snprintfsprintf$AttributesCreateDeleteEnterLeaveMove_vsnprintflstrcmpstrstrwcsrchr
                                                                                                                                                                                                              • String ID: %s.Blocked "%S" from creating "%S"$%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!$.exe$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$autorun.inf$pdef
                                                                                                                                                                                                              • API String ID: 2285763329-983484825
                                                                                                                                                                                                              • Opcode ID: 0bb941aff2b33f4f33166266e4624ccd946dec18eef9a9a009d653ab6adc98fd
                                                                                                                                                                                                              • Instruction ID: 767322c83212b5698aabde80e4d44f6b16f99ddbb09b22e2f03322de5ae40dfa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0bb941aff2b33f4f33166266e4624ccd946dec18eef9a9a009d653ab6adc98fd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 19118979BC031033DA1037597C47FCB36494B51B56F164037FA15F12D2D9ADD8A085AE
                                                                                                                                                                                                              Function 00407100 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 102stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _wcsnicmplstrcpymemset
                                                                                                                                                                                                              • String ID: %S%S%S$%s.%S%S$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
                                                                                                                                                                                                              • API String ID: 1531173107-4065158899
                                                                                                                                                                                                              • Opcode ID: 4d42de66ec45cd411ac5666ad87da4cd38ce08a0da5c330b01549170799906db
                                                                                                                                                                                                              • Instruction ID: 0d62909f67cd26c4267f5d97f7bb411455192b825f2191604f2d867da3f0bcac
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d42de66ec45cd411ac5666ad87da4cd38ce08a0da5c330b01549170799906db
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5310B71E853147AD710DF849C46FEB336CDF98745F10416BFD04B2282E578B99086AE
                                                                                                                                                                                                              Function 00403C90 Relevance: 16.7, APIs: 11, Instructions: 227filepipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32 ref: 00403DA4
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-00417960,00000800,00000000), ref: 00403DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,00417960,00000800,00000000,?), ref: 00403ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403EF3
                                                                                                                                                                                                              • DisconnectNamedPipe.KERNEL32(?,?,?,00000000,000000FF,?,?), ref: 00403F68
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(?,?,?,?,00000000,000000FF,?,?), ref: 00403F7E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileNamedPipeRead$ConnectDisconnectMultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4113577031-0
                                                                                                                                                                                                              • Opcode ID: 2dd0d3f7e6905856f8620d5e3fef185a33115fdb9533bf0cb694795480849065
                                                                                                                                                                                                              • Instruction ID: ac3e6ea8bc8c8074bcac9458f0b4c946774cbfc70c0eded63f488d96161438d0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dd0d3f7e6905856f8620d5e3fef185a33115fdb9533bf0cb694795480849065
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D691C3B5604219AFE714CF28D8C4FAA7BB8FF49305F004279E94597390C775EA51CBA4
                                                                                                                                                                                                              Function 00409080 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 114COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 004090A0
                                                                                                                                                                                                                • Part of subcall function 0040A0F0: wcsrchr.MSVCRT ref: 0040A0FA
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00409101
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememsetwcsrchr
                                                                                                                                                                                                              • String ID: %s.Blocked possible browser exploit pack call on URL '%s'$com$exe$firefox.exe$http$iexplore.exe$pdef$pif$scr
                                                                                                                                                                                                              • API String ID: 519477765-3787805686
                                                                                                                                                                                                              • Opcode ID: 9feddec9e16c461d5e2da787cbb62269d4fe3e75ad441ddebd7cf50a6250c1d5
                                                                                                                                                                                                              • Instruction ID: efd4538f4b4db184858f8da92d63e99c1f835ee883837e794a8278ba3a2532b2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9feddec9e16c461d5e2da787cbb62269d4fe3e75ad441ddebd7cf50a6250c1d5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C31E6B5A443056AEB20DB519C0AFE7376C9B10345F00426AFD14A62D3E679ED50C6AA
                                                                                                                                                                                                              Function 0040B160 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 69stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00406E9C,00000000,00000000,00000000,?,?,00406E9C), ref: 0040B178
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,-00000002,?,?,00406E9C), ref: 0040B186
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00406E9C,?,?,00406E9C), ref: 0040B18F
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040B19F
                                                                                                                                                                                                              • strstr.MSVCRT ref: 0040B1B6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1C3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,-00000002,?,?,?,?,?,00406E9C), ref: 0040B1D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1DC
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00406E9C), ref: 0040B1E5
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040B1F8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Allocstrstr$Freelstrcpyn
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1314289781-2344752452
                                                                                                                                                                                                              • Opcode ID: 671df700651087db9f68e88acf1a80bfe8468f7de7138985c6537d20367a1117
                                                                                                                                                                                                              • Instruction ID: 0c7384581528d42b7d5f36e6acbd12e0b896a5cfd03da8e96f22c4e7025091be
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 671df700651087db9f68e88acf1a80bfe8468f7de7138985c6537d20367a1117
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4C1177769413147BD710ABA59C45FDB7BACDF49751F004426FB04E3251DAB8ED0087E8
                                                                                                                                                                                                              Function 0040FC90 Relevance: 16.6, APIs: 7, Strings: 4, Instructions: 57stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040FCB0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0040FCBD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040FCE0
                                                                                                                                                                                                              • lstrcpyW.KERNEL32(0044B9A0,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 0040FCF2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044BDB0,RECYCLED), ref: 0040FD08
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044BEB4,?), ref: 0040FD16
                                                                                                                                                                                                                • Part of subcall function 0040F9E0: memset.MSVCRT ref: 0040F9FF
                                                                                                                                                                                                                • Part of subcall function 0040F9E0: GetLogicalDriveStringsA.KERNEL32 ref: 0040FA22
                                                                                                                                                                                                                • Part of subcall function 0040F9E0: lstrcatA.KERNEL32(00000000,00413040), ref: 0040FA5C
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0040FD61
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcpy$memset$DriveLogicalSleepStrings_snprintflstrcatlstrlen
                                                                                                                                                                                                              • String ID: %0x.exe$30e44aa1$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$RECYCLED
                                                                                                                                                                                                              • API String ID: 530497602-16990919
                                                                                                                                                                                                              • Opcode ID: e730cdf07b84502abd0107d0f1998adf04288a9b3c265073001481b0d79274c8
                                                                                                                                                                                                              • Instruction ID: dc7a5fa392d0d149d72329117f2babda223c444661474c01379b6b2072300756
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e730cdf07b84502abd0107d0f1998adf04288a9b3c265073001481b0d79274c8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D611C8B9940318BBD310AF65AC82BD5B678EB49704F50407BF604A21D1D7F859C48F9D
                                                                                                                                                                                                              Function 0040AC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000000,?,00000000,?), ref: 0040AC1A
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0040AC3E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040AC44
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(00600000,00000008,00000000,?), ref: 0040AC5E
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0040AC79
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(POST,00000000), ref: 0040AC85
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040AC99
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040ACB2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 770645459-1814004025
                                                                                                                                                                                                              • Opcode ID: fdf47e3c856405845c85ea16ba9a9e54b5ee40ff6769a125eeb271a545ff0a5a
                                                                                                                                                                                                              • Instruction ID: 0fbffbe8e505b5e8b43b1d96c34f4003dc7e44b5e0767985707ba2deb4e71632
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fdf47e3c856405845c85ea16ba9a9e54b5ee40ff6769a125eeb271a545ff0a5a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF218135645214BBE7209BA5AC88EEBBB7CEB89750F10816AFA04E2250D6349D10C7A9
                                                                                                                                                                                                              Function 0040A690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79processCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040A6AF
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040A6CA
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000000), ref: 0040A6DF
                                                                                                                                                                                                              • PathAppendW.SHLWAPI(?,Internet Explorer\iexplore.exe), ref: 0040A6F9
                                                                                                                                                                                                              • _snwprintf.MSVCRT ref: 0040A71B
                                                                                                                                                                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 0040A77F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Pathmemset$AppendCreateFolderProcessSpecial_snwprintf
                                                                                                                                                                                                              • String ID: "%s" %S$D$Internet Explorer\iexplore.exe
                                                                                                                                                                                                              • API String ID: 1165436438-694066683
                                                                                                                                                                                                              • Opcode ID: 60cd83263cb24385c2d1f1725d9021ca31634a09a844885a414652a094c2e99e
                                                                                                                                                                                                              • Instruction ID: 04848a9af665ce3946de5b24cb2a47d1feeda1f9a2b65442b6e860eb45006ae4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60cd83263cb24385c2d1f1725d9021ca31634a09a844885a414652a094c2e99e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4421A971940308BAEB10DBA0CC46FEA7378AF44B01F148599B7097A1C1EBF59A448B9D
                                                                                                                                                                                                              Function 00401000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 0040100D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,0044AA28), ref: 00401054
                                                                                                                                                                                                              • MoveFileExA.KERNEL32 ref: 00401062
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00416D88,?), ref: 0040108B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00416E90,?), ref: 00401093
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: %s.%s$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 4105673886-2504170642
                                                                                                                                                                                                              • Opcode ID: f752920ade5beb6bd2a52fa87a8803d44ba52a480dd333d8196198b85d7169fa
                                                                                                                                                                                                              • Instruction ID: 4fe7375c48cb0ed1c8aec0ef7938256b6d24936e215c646bbef161c2785726af
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f752920ade5beb6bd2a52fa87a8803d44ba52a480dd333d8196198b85d7169fa
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0701F53678021477D3205B69AC49FDBB79CDB58764B140037FB08E26A1D678D880C27E
                                                                                                                                                                                                              Function 00409430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
                                                                                                                                                                                                                • Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00409467
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00409490
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 004094BD
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004094C1
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000002,00000011), ref: 004094F6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00409511
                                                                                                                                                                                                              • sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 0040953C
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 00409549
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00409559
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 00409564
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2400900511-0
                                                                                                                                                                                                              • Opcode ID: 08cdf173da6e0b52d7b4d90e9b8344553a2d1643b6037e8e8fd29483bb7c0b4b
                                                                                                                                                                                                              • Instruction ID: a87c336d0ea31640531df1928f9ed9f7433797ef1bdd0e7b1cbf387240af0400
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 08cdf173da6e0b52d7b4d90e9b8344553a2d1643b6037e8e8fd29483bb7c0b4b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B93130729002246BD710BBFB8D46BEEB2999F88308F11453BF905F71D2D5B89D41C7AA
                                                                                                                                                                                                              Function 0040ACD0 Relevance: 15.1, APIs: 10, Instructions: 107memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040ACF5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00600000,00000008,00000000,?,00000000,?), ref: 0040AD0A
                                                                                                                                                                                                              • InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0040AD2B
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040AD31
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(00600000,00000008,00000000,?), ref: 0040AD4F
                                                                                                                                                                                                              • InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0040AD63
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 0040AD80
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040AD93
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000000), ref: 0040ADB3
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040ADE6
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocInternetOptionQuery$??2@ByteCharErrorFreeLastMultiWidelstrcpymemset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3155763378-0
                                                                                                                                                                                                              • Opcode ID: cb084f2b6773a05dcd76a5740ced886a2a6f71689aa4d9ebc6c2ce4d88e1e85a
                                                                                                                                                                                                              • Instruction ID: 00504cc4e49c33e4c2d117f02b4e2dde52e53599f86eef1a5ae60fdc04d2353b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cb084f2b6773a05dcd76a5740ced886a2a6f71689aa4d9ebc6c2ce4d88e1e85a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42317C74500305BBD7209B95CC85FEBBBB9EF8A711F108165FA04AB2D0D7B49D40CBA9
                                                                                                                                                                                                              Function 00409330 Relevance: 15.1, APIs: 10, Instructions: 81networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
                                                                                                                                                                                                                • Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 0040935D
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 0040936F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00409373
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000000), ref: 004093A6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004093C1
                                                                                                                                                                                                              • connect.WS2_32(?,?,00000010), ref: 004093DE
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 004093EB
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 004093F8
                                                                                                                                                                                                              • Sleep.KERNEL32(0000004B,?), ref: 00409405
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00409407
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleep$closesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1090714710-0
                                                                                                                                                                                                              • Opcode ID: de3095b561cd0ee4a074b4b2388ced171c2f3cf8f2c1d860a68ce1fb6dd27ffa
                                                                                                                                                                                                              • Instruction ID: d2cec284f92f2c482fe6d1749ee7125162ceb74f25a5afa3c33734025d3d2087
                                                                                                                                                                                                              • Opcode Fuzzy Hash: de3095b561cd0ee4a074b4b2388ced171c2f3cf8f2c1d860a68ce1fb6dd27ffa
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 90210872800224ABC720FBB9DD45BCEF769DB88304F01462AF908F72D1D6B49D81CB99
                                                                                                                                                                                                              Function 004089B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 004089C5
                                                                                                                                                                                                              • AcquireCredentialsHandleW.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 00408A32
                                                                                                                                                                                                              • QueryContextAttributesW.SECUR32(?,00000004,00000001), ref: 00408AC3
                                                                                                                                                                                                              • InitializeSecurityContextW.SECUR32(?,00000000,?,0008C11C,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00408A79
                                                                                                                                                                                                                • Part of subcall function 00408760: FreeContextBuffer.SECUR32(?), ref: 00408774
                                                                                                                                                                                                                • Part of subcall function 00408790: InitializeSecurityContextW.SECUR32(?,?,?,0008C11C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 004088AE
                                                                                                                                                                                                              • DeleteSecurityContext.SECUR32(?), ref: 00408B17
                                                                                                                                                                                                              • FreeCredentialsHandle.SECUR32(?), ref: 00408B1E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Context$Security$CredentialsFreeHandleInitialize$AcquireAttributesBufferDeleteQuerymemset
                                                                                                                                                                                                              • String ID: $Microsoft Unified Security Protocol Provider
                                                                                                                                                                                                              • API String ID: 3657786480-3891800672
                                                                                                                                                                                                              • Opcode ID: dcdf4e7042a4ea6511e14daa0a12ea5c36e3752beb23f15a638fe31564bb052c
                                                                                                                                                                                                              • Instruction ID: beda717db611c482a8f93d0b8a0973b6a55a9a325cb36f24a7304a88d952abe4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dcdf4e7042a4ea6511e14daa0a12ea5c36e3752beb23f15a638fe31564bb052c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 605127B1D00208ABDB20DFAADD859EFFBF8FF94704F10452EE505E6251E7B4A6058B64
                                                                                                                                                                                                              Function 00401D10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 00401D31
                                                                                                                                                                                                              • memset.MSVCRT ref: 00401D4B
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 00401D9B
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00401DAB
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000400), ref: 00401DCA
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000200,00000000,00000000), ref: 00401E0C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememset$lstrcmpstrstr
                                                                                                                                                                                                              • String ID: bdns$block
                                                                                                                                                                                                              • API String ID: 1883446694-4143068083
                                                                                                                                                                                                              • Opcode ID: 91300e0d32c94e868e96abe87e6cea2bf92f63cc49db3d24d78b2731c014a31b
                                                                                                                                                                                                              • Instruction ID: 02cb723c2acadd3014a6e1aa2f0b914f9df801f99115c0613e607c9dec7c965c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 91300e0d32c94e868e96abe87e6cea2bf92f63cc49db3d24d78b2731c014a31b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B313A756403087BEB20DB55EC0AFEB736CDF84710F00416AFE14B62D1EAB4AE50C6A9
                                                                                                                                                                                                              Function 00409C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strtok.MSVCRT ref: 00409C7C
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 00409C9A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(0044B648,00411335), ref: 00409CB3
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(0044B648,00000000,00000200), ref: 00409CC4
                                                                                                                                                                                                              • strtok.MSVCRT ref: 00409CDB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 00409CE8
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 00409D73
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [Slowloris]: Finished flood on "%s", xrefs: 00409D45
                                                                                                                                                                                                              • [Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 00409CF9
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
                                                                                                                                                                                                              • String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
                                                                                                                                                                                                              • API String ID: 1726920797-1250431664
                                                                                                                                                                                                              • Opcode ID: 02698c9e1c9b5a337fd9f870c731ce9dae944a898e9a5d2947721506a0970c02
                                                                                                                                                                                                              • Instruction ID: 5abb1ecf655548da32f96995d5207bda4e63050bb647f4713687c5726d83be91
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 02698c9e1c9b5a337fd9f870c731ce9dae944a898e9a5d2947721506a0970c02
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6C2198B6780704ABE310ABA5AC47FE7369CE754755F10403AF608A61D1D7BD98408BED
                                                                                                                                                                                                              Function 00410BB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,GetAddrInfoW), ref: 00410C14
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,send), ref: 00410C26
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _stricmp
                                                                                                                                                                                                              • String ID: GetAddrInfoW$dnsapi.dll$nspr4.dll$send$wininet.dll
                                                                                                                                                                                                              • API String ID: 2884411883-3553644081
                                                                                                                                                                                                              • Opcode ID: 36e3ed33dabe1e89e10d8de8e0c2c552be30b71190476765e5e888efa949d741
                                                                                                                                                                                                              • Instruction ID: 7dd899092242fc79fd89890ffa549661517dd11cf2dee8623fb0997b335437d9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 36e3ed33dabe1e89e10d8de8e0c2c552be30b71190476765e5e888efa949d741
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C3118633B41130629A2455A6AD01BDBA2485B60767F050237FD09E2381E5DDEAD195EE
                                                                                                                                                                                                              Function 0040C8C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C8DD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C8E5
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00412C78,?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0), ref: 0040C907
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?,?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0), ref: 0040C913
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,http.int,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C985
                                                                                                                                                                                                              • atoi.MSVCRT(?,?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C99C
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 0040C9AF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: atoilstrcatlstrlen$lstrcmp
                                                                                                                                                                                                              • String ID: [HTTP]: Updated HTTP spread message to "%s"$http$msg
                                                                                                                                                                                                              • API String ID: 3861295430-3390247340
                                                                                                                                                                                                              • Opcode ID: cd66be1e72c6cf93dfedc839c2d5169449ca9746f87a431d2b3f8e4c18d29906
                                                                                                                                                                                                              • Instruction ID: 1ab7614cfbc0b4fce2ff95c09ce7119ec81f183615a4560a58167f2487451b67
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cd66be1e72c6cf93dfedc839c2d5169449ca9746f87a431d2b3f8e4c18d29906
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6601657594020CAADB20DF60CC81EDAB378AF44304F2045ABD549A3192DB78FA86CF65
                                                                                                                                                                                                              Function 0040DD20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 36sleepthreadnetworkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 0040DD7B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CleanupCountCriticalExitInitializeSectionSleepThreadTick
                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe
                                                                                                                                                                                                              • API String ID: 544336047-976232588
                                                                                                                                                                                                              • Opcode ID: 45cafbe1ea53cd53aec28c77d21da2276e5172413c87d9c6706ecdba95742d04
                                                                                                                                                                                                              • Instruction ID: 7f0fa1591e1ee0be880222c6a73bc66ebc889f5a3643ae2c22fe3d04a35b960a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 45cafbe1ea53cd53aec28c77d21da2276e5172413c87d9c6706ecdba95742d04
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 81F090B1D4061466D7203BF97D096AE36545F14329B204A37FB15E22F0EB3C89458AAE
                                                                                                                                                                                                              Function 00403DB8 Relevance: 12.1, APIs: 8, Instructions: 108fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-00417960,00000800,00000000), ref: 00403DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,00417960,00000800,00000000,?), ref: 00403ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403EF3
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32 ref: 00403F0D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403F1D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 146293752-0
                                                                                                                                                                                                              • Opcode ID: 48b095c9934a17c5a57d935e29c9e11065415f2b5555cb5260d4dacb11bb4326
                                                                                                                                                                                                              • Instruction ID: 1449663287717f94bd81a238159e52aac75588b2a5b986027c9b27bc7671b927
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 48b095c9934a17c5a57d935e29c9e11065415f2b5555cb5260d4dacb11bb4326
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1541D1B4600219AFE710CF68DCC4FAA7BA8FF49304F408668E64597391C731EA11CBA9
                                                                                                                                                                                                              Function 00403DB6 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-00417960,00000800,00000000), ref: 00403DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,00417960,00000800,00000000,?), ref: 00403ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403EF3
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32 ref: 00403F0D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403F1D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 146293752-0
                                                                                                                                                                                                              • Opcode ID: a3c2b8a4d836f326ba00dd01a2af7da35a594ae8b6e1fa1924fa689e7bbf5e23
                                                                                                                                                                                                              • Instruction ID: 28271791b9155c45bfcfa5e5e937157ac637d84904cf2cf721747741308823d4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a3c2b8a4d836f326ba00dd01a2af7da35a594ae8b6e1fa1924fa689e7bbf5e23
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0341B2B4600219AFE710CF68DCC4FAA7B68FF49304F408669E64597391C735EA51CBA9
                                                                                                                                                                                                              Function 00407500 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 99stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintf_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 3897371274-741241040
                                                                                                                                                                                                              • Opcode ID: 124a044a6255b2877a249701a6b566efcd5087fe13bd7a91ca914f4277930df7
                                                                                                                                                                                                              • Instruction ID: 4041c77a8ee822b0534c788c84e6158342a9e1cd2e52badc2954bd78d4f0e51c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 124a044a6255b2877a249701a6b566efcd5087fe13bd7a91ca914f4277930df7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5421E672A00219BBDB209F69AC85FEB775CEB44714F04457ABE09E3681E638DD0086E5
                                                                                                                                                                                                              Function 00408670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103C), ref: 00408688
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 004086AE
                                                                                                                                                                                                              • inet_ntoa.WS2_32(?), ref: 004086F7
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00408704
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00408713
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00408640,00000000,00000000,00000000), ref: 00408734
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040873B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 30336511-0
                                                                                                                                                                                                              • Opcode ID: ece531b689def736ad1a046acb75a9b161b153146826fb4c6ab30ca57e0e27f5
                                                                                                                                                                                                              • Instruction ID: 9e76b70b9e18d90a2322bacb59208b5161888f5b1f8e4907ee1d559a765b4a15
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ece531b689def736ad1a046acb75a9b161b153146826fb4c6ab30ca57e0e27f5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F221087894071096D3205B71ED097D77AA4AF08304F10493EF6ED972D0DBF895808B5D
                                                                                                                                                                                                              Function 00407790 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 69stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlenmemset$_snprintflstrcpy
                                                                                                                                                                                                              • String ID: off$state_%s
                                                                                                                                                                                                              • API String ID: 1009457118-628336787
                                                                                                                                                                                                              • Opcode ID: 5b6905d1f6e2b7b534780aeee88cc8939b47f5c0091e7a4f985c36332bd66e18
                                                                                                                                                                                                              • Instruction ID: 92198304c3aebce230d4dd1ef02d57304f56152abc6317e3f91bbe1a6584e8e5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b6905d1f6e2b7b534780aeee88cc8939b47f5c0091e7a4f985c36332bd66e18
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5711E1B598131877D720E755CD46FEA736C9F88704F0041EAF748661C2E6F86BC48AA9
                                                                                                                                                                                                              Function 00402A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00402A44
                                                                                                                                                                                                                • Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
                                                                                                                                                                                                                • Part of subcall function 00402460: HeapAlloc.KERNEL32(00600000,00000008,004020DE,?,004020DE,?), ref: 0040247E
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00402A8A
                                                                                                                                                                                                              • WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 00402A96
                                                                                                                                                                                                              • GetLastError.KERNEL32(00000002,00000001,00000006), ref: 00402A9B
                                                                                                                                                                                                                • Part of subcall function 004024A0: GetProcessHeap.KERNEL32(00000000,?,00402131,00000000), ref: 004024B4
                                                                                                                                                                                                                • Part of subcall function 004024A0: HeapFree.KERNEL32(00600000,00000000,1!@), ref: 004024C3
                                                                                                                                                                                                              • inet_ntoa.WS2_32(00000002), ref: 00402AEE
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 00402AFC
                                                                                                                                                                                                              • Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 00402B0B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 268164981-0
                                                                                                                                                                                                              • Opcode ID: 44dedb86cd978a286b815524257946b4e4894fd2ee4a2f55442f8e7975e1c89b
                                                                                                                                                                                                              • Instruction ID: ce191278c195bcc5fe46e87e2f95668e3f48f171ff9216de77ec0a31515bc727
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44dedb86cd978a286b815524257946b4e4894fd2ee4a2f55442f8e7975e1c89b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F4411C71E00204ABCB10EFA9D985AAFB3B5EF44324F10457BE519EB3C0D6B9A941CB85
                                                                                                                                                                                                              Function 00407F90 Relevance: 10.6, APIs: 7, Instructions: 131networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 00407FD4
                                                                                                                                                                                                              • send.WS2_32(?,?,?,00000000), ref: 00407FFB
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,00000000,?), ref: 00408004
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,00000000,00000001,?), ref: 0040803D
                                                                                                                                                                                                              • select.WS2_32(00000000,?,00000000,00000000,?), ref: 00408081
                                                                                                                                                                                                              • recv.WS2_32(?,?,00001000,00000000), ref: 0040809A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: select$FreeLocalrecvsend
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1822081929-0
                                                                                                                                                                                                              • Opcode ID: 0871b2e34e756f4d0f63523cb201b98f0c40d0ec107a21b26a04a251aac6ff47
                                                                                                                                                                                                              • Instruction ID: 909fc2e90b0f87b3fef5befaca8da21e2df52dd308851a13e64ceea63d8b760f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0871b2e34e756f4d0f63523cb201b98f0c40d0ec107a21b26a04a251aac6ff47
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A41AC712003049BD730DB69D881BE7B3F8EB88710F004A9FF5899B681E6F5A9C48B94
                                                                                                                                                                                                              Function 00406E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
                                                                                                                                                                                                                • Part of subcall function 00402460: HeapAlloc.KERNEL32(00600000,00000008,004020DE,?,004020DE,?), ref: 0040247E
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0040AFBD
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: HeapAlloc.KERNEL32(00600000,00000008,-00000002), ref: 0040AFCB
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: memset.MSVCRT ref: 0040AFE8
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: memset.MSVCRT ref: 0040B002
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: lstrlenA.KERNEL32(?), ref: 0040B013
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: sscanf.MSVCRT ref: 0040B02A
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: strtok.MSVCRT ref: 0040B041
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: _memicmp.MSVCRT ref: 0040B05B
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: strtok.MSVCRT ref: 0040B06E
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B09B
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B0AD
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B0BB
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B0C6
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: HeapAlloc.KERNEL32(00600000,00000000,?), ref: 0040B0D5
                                                                                                                                                                                                                • Part of subcall function 0040AFA0: _memicmp.MSVCRT ref: 0040B0EB
                                                                                                                                                                                                              • strstr.MSVCRT ref: 00406EBC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 00406EC9
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?), ref: 00406EE7
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 00406F1A
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 00406F2C
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,00000000), ref: 00406F3C
                                                                                                                                                                                                                • Part of subcall function 0040B160: lstrlenA.KERNEL32(00406E9C,00000000,00000000,00000000,?,?,00406E9C), ref: 0040B178
                                                                                                                                                                                                                • Part of subcall function 0040B160: HeapAlloc.KERNEL32(00600000,00000008,-00000002,?,?,00406E9C), ref: 0040B186
                                                                                                                                                                                                                • Part of subcall function 0040B160: lstrlenA.KERNEL32(00406E9C,?,?,00406E9C), ref: 0040B18F
                                                                                                                                                                                                                • Part of subcall function 0040B160: strstr.MSVCRT ref: 0040B19F
                                                                                                                                                                                                                • Part of subcall function 0040B160: strstr.MSVCRT ref: 0040B1B6
                                                                                                                                                                                                                • Part of subcall function 0040B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1C3
                                                                                                                                                                                                                • Part of subcall function 0040B160: HeapAlloc.KERNEL32(00600000,00000008,-00000002,?,?,?,?,?,00406E9C), ref: 0040B1D2
                                                                                                                                                                                                                • Part of subcall function 0040B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1DC
                                                                                                                                                                                                                • Part of subcall function 0040B160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00406E9C), ref: 0040B1E5
                                                                                                                                                                                                                • Part of subcall function 0040B160: HeapFree.KERNEL32(00600000,00000000,00000000), ref: 0040B1F8
                                                                                                                                                                                                                • Part of subcall function 004101E0: memset.MSVCRT ref: 00410202
                                                                                                                                                                                                                • Part of subcall function 004101E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00410213
                                                                                                                                                                                                                • Part of subcall function 004101E0: EnterCriticalSection.KERNEL32(0044B4E4), ref: 00410223
                                                                                                                                                                                                                • Part of subcall function 004101E0: strstr.MSVCRT ref: 00410243
                                                                                                                                                                                                                • Part of subcall function 004101E0: lstrlenA.KERNEL32(00000000), ref: 00410254
                                                                                                                                                                                                                • Part of subcall function 004101E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0041025F
                                                                                                                                                                                                                • Part of subcall function 004101E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 00410272
                                                                                                                                                                                                                • Part of subcall function 004101E0: strstr.MSVCRT ref: 00410281
                                                                                                                                                                                                                • Part of subcall function 004101E0: _snprintf.MSVCRT ref: 004102C8
                                                                                                                                                                                                                • Part of subcall function 004101E0: strstr.MSVCRT ref: 004102EF
                                                                                                                                                                                                                • Part of subcall function 004101E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 004103E4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 836748388-1814004025
                                                                                                                                                                                                              • Opcode ID: 562dd2a2906666e8d5d78590dbbe1f82c56a871b10fee489a4b4aa9520b9b78c
                                                                                                                                                                                                              • Instruction ID: cc10cac82836c26b039bb3b82ce5bd358b0495aa14e7187af42939d2a19edcdf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 562dd2a2906666e8d5d78590dbbe1f82c56a871b10fee489a4b4aa9520b9b78c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6331D675900205BBCB10DFA5EC85E9B776CEB84304F15417EFA09A7380DA79ED6087AE
                                                                                                                                                                                                              Function 00402F90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103injectionCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 00402FD2
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 0040301C
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 00403036
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 00403053
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MemoryProcess$Write$Read
                                                                                                                                                                                                              • String ID: $g\@
                                                                                                                                                                                                              • API String ID: 2454571318-100232733
                                                                                                                                                                                                              • Opcode ID: afba040f6b78dad9a64a69251b00c2452e7616e1452184dac7652ca053b11117
                                                                                                                                                                                                              • Instruction ID: df94579fe5779622c4b9a2bbeb87517a31d4cf809518c5bbba1c78cdbb14ede0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: afba040f6b78dad9a64a69251b00c2452e7616e1452184dac7652ca053b11117
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D2318DB2A0150DAADB10DE99DC80EEFB77CEB40751F10412AEA04E6288E775AF45C7A4
                                                                                                                                                                                                              Function 0040D110 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 98stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpynlstrlenmemmovememsetstrchr
                                                                                                                                                                                                              • String ID: 332
                                                                                                                                                                                                              • API String ID: 3300951897-3855660651
                                                                                                                                                                                                              • Opcode ID: 88e81665c889f28b239df7cd6c984e6028ebf26d374a202a1f7358562cae9db4
                                                                                                                                                                                                              • Instruction ID: e19f26a57a8d371ee74b48060b1fbe9b9ea883c41348451d97a1bc845706ce98
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 88e81665c889f28b239df7cd6c984e6028ebf26d374a202a1f7358562cae9db4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57310475900206BBE7209B69CC89FA77B6CEF44344F044179B909A7282EA74ED45C7B4
                                                                                                                                                                                                              Function 00407610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf_vsnprintflstrcmplstrlen
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 4220314296-741241040
                                                                                                                                                                                                              • Opcode ID: 23ec7fce3546beb37acd49c2d85190782378fbd514bc716e8a0b894e0436e7ca
                                                                                                                                                                                                              • Instruction ID: 788de98c1237337ff7e2880e90b2af97be5818e55d19a1934294188661e30183
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23ec7fce3546beb37acd49c2d85190782378fbd514bc716e8a0b894e0436e7ca
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08212B72B002186BD7209F69ECC5FE77358EB44714F04497AFD19E3241E675D94087E5
                                                                                                                                                                                                              Function 00403B90 Relevance: 10.6, APIs: 7, Instructions: 82pipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,00405182,?,?,?,d1ff3a37), ref: 00403BD8
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(?,40000001,00000000,000000FF,00010000,00010000,00000000,00000000), ref: 00403C0F
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000,?,?,?,?,00405182,?,?,?,d1ff3a37), ref: 00403C25
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00405182,?,?,?,d1ff3a37), ref: 00403C2F
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00405182,?,?,?,d1ff3a37), ref: 00403C46
                                                                                                                                                                                                              • SetEvent.KERNEL32(00000000,?,?,?,00405182,?,?,?,d1ff3a37), ref: 00403C56
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateErrorEventLastNamedPipe$Connect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3507186782-0
                                                                                                                                                                                                              • Opcode ID: 37271feab1efd766603c5ed1eb9c75c67124974bf2be737a9f078a6ab44b23cc
                                                                                                                                                                                                              • Instruction ID: c73fd8eed312285066e6433c0d2a5033b489b0f8818e27d85342ab9d2f4f481c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37271feab1efd766603c5ed1eb9c75c67124974bf2be737a9f078a6ab44b23cc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5F21D8767442057BE7209F64DCC4BD6BB68EB44751F208536FB0DEA2D0D3B4E9408758
                                                                                                                                                                                                              Function 004081C0 Relevance: 10.6, APIs: 7, Instructions: 61networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 004081E3
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 004081F9
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040820F
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 0040821A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Startupclosesocketioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3235567692-0
                                                                                                                                                                                                              • Opcode ID: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
                                                                                                                                                                                                              • Instruction ID: 2b0dcf704551c650d29533d06b19cfcaca382403250199c2a733ecaf4d854171
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0301D67164031875EA20E6A59D07FFE725CCF05728F0006AAFB18BA1C1EBF95AD542DD
                                                                                                                                                                                                              Function 0040A64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040E750,00000000,00000000,00000000), ref: 0040A659
                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 0040A66F
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040A678
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0040A680
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 0040A666
                                                                                                                                                                                                              • ngrBot Error, xrefs: 0040A661
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateExitMessageObjectProcessSingleThreadWait
                                                                                                                                                                                                              • String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
                                                                                                                                                                                                              • API String ID: 2697768853-1169653777
                                                                                                                                                                                                              • Opcode ID: ef5e2cb8f22fc0210164a191ddb43d318e3842e5a1d98e74102cfaaa7881f373
                                                                                                                                                                                                              • Instruction ID: dc0d325c1072b72e0d8e59aa08d1cae9c16ec156ffef70dd10597c0366fd65a5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef5e2cb8f22fc0210164a191ddb43d318e3842e5a1d98e74102cfaaa7881f373
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22E06735BC5351B7E62017A05D0BFC429249B08F52F218661B315FE4E0C6E42190475D
                                                                                                                                                                                                              Function 00407330 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 60stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: %s_
                                                                                                                                                                                                              • API String ID: 3230270962-1040268105
                                                                                                                                                                                                              • Opcode ID: 9640c39e07aa5882a926e3bcb213b2f2f359a6334437b7d8734b327d600d5778
                                                                                                                                                                                                              • Instruction ID: 5826c9583f370a1dd932e8f72a1f935f9ca8b57465acbcc929005ef802fb48eb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9640c39e07aa5882a926e3bcb213b2f2f359a6334437b7d8734b327d600d5778
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B114CB2A4031937F720E6698C86FF7736CDF84700F0405BDBE1853182E5B49E4087A4
                                                                                                                                                                                                              Function 004102A9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 57memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 004102C8
                                                                                                                                                                                                              • strstr.MSVCRT ref: 004102EF
                                                                                                                                                                                                              • atoi.MSVCRT(00000000,?,http,int), ref: 00410322
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00410386
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 004103E4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 004103EE
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044B4E4), ref: 004103FD
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041041F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$CriticalLeaveSection_snprintfatoilstrlenstrstr
                                                                                                                                                                                                              • String ID: %s=
                                                                                                                                                                                                              • API String ID: 1805118874-2646424381
                                                                                                                                                                                                              • Opcode ID: ee71abe191ac5c5f67e6a76e53e66d7266845c4f9d38bb18f3292e0e6c04068d
                                                                                                                                                                                                              • Instruction ID: 18d3edc493bc3f403bf92720d977da1dbff54a17adae19d127435001e8f83a82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee71abe191ac5c5f67e6a76e53e66d7266845c4f9d38bb18f3292e0e6c04068d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CC11A971A4031DABDB209751CC81BFBB378EB84305F14416BEE1963240DAB8FDC18BA9
                                                                                                                                                                                                              Function 004050F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040510F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00405122
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040512B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-comm$d1ff3a37
                                                                                                                                                                                                              • API String ID: 3057366584-284086203
                                                                                                                                                                                                              • Opcode ID: a93b1516683958c1d9d60c9ee514b9fb12ccde5092aeeca8bbe9916ea1720a1c
                                                                                                                                                                                                              • Instruction ID: 467e8c21684c0235fe829960707385420c5f419fa334f9ea544b7238d55dbfde
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a93b1516683958c1d9d60c9ee514b9fb12ccde5092aeeca8bbe9916ea1720a1c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44210875A802047BE714DF91CC46FEB3328B784706F1409AAF504A72D2E6B89E44DBA8
                                                                                                                                                                                                              Function 0040E4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79sleepmemorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A013
                                                                                                                                                                                                                • Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A04F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040E517
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 0040E525
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0040E54E
                                                                                                                                                                                                              • HeapFree.KERNEL32(00600000,00000000,?), ref: 0040E57A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strtok$FreeHeapSleep_memicmplstrlen
                                                                                                                                                                                                              • String ID: [Login]: %s
                                                                                                                                                                                                              • API String ID: 2470415281-2266835287
                                                                                                                                                                                                              • Opcode ID: dbf4343face418a870bb8425e8e66a13a343c3042656d238115fe0c3f70b93bf
                                                                                                                                                                                                              • Instruction ID: 783aa63cf0ce7d9ff363f5601bd85304eb0c082eb699b2ee8fe1f1afe810e237
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dbf4343face418a870bb8425e8e66a13a343c3042656d238115fe0c3f70b93bf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EC21DAB1640204BBD720DB96DD81FAB77ACDB84745F10483AF904533C1E7BD9D61C6A9
                                                                                                                                                                                                              Function 00401C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 00401C6E
                                                                                                                                                                                                                • Part of subcall function 00403750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 0040376B
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00401CC6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00401CD9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$AddressCloseFileModuleProcedureWrite
                                                                                                                                                                                                              • String ID: CreateFileW$kernel32.dll
                                                                                                                                                                                                              • API String ID: 2185083974-2113957990
                                                                                                                                                                                                              • Opcode ID: 5e17a910bcfb5ef4f4a3bb6a75b813b505dab38d25974d635e36853e68971060
                                                                                                                                                                                                              • Instruction ID: 3516dd70821b321a82e3fccae0f5f19e3dd812fe4f74b4804ac45d1edfcd853e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5e17a910bcfb5ef4f4a3bb6a75b813b505dab38d25974d635e36853e68971060
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FA012BB16441187FE7049F68DC85FEB735DAB49714F148239FA15A32E0D2B49D0553A8
                                                                                                                                                                                                              Function 00406D90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,00406C55,00000000), ref: 00406DA1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                                                                              • String ID: NtQueryInformationProcess$NtSetInformationProcess$Ul@$ntdll.dll
                                                                                                                                                                                                              • API String ID: 4139908857-2971258217
                                                                                                                                                                                                              • Opcode ID: 62a2a73916b9af1f8daf532ab0fdb30c97b42ff7dfa5a627ce04c4475a55d3f5
                                                                                                                                                                                                              • Instruction ID: e665a3cd0ad87b6e4d351724504253e06bb2307510cb7435dea9c92ab51fd615
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 62a2a73916b9af1f8daf532ab0fdb30c97b42ff7dfa5a627ce04c4475a55d3f5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E01D4B234131837EA205A49DC45FEB779CCB85769F010167FE08B72C0DAB99D4082E8
                                                                                                                                                                                                              Function 0040FAA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProcWindowsprintf
                                                                                                                                                                                                              • String ID: %c:\$@WA$[USB]: Infected %s
                                                                                                                                                                                                              • API String ID: 3179433310-3310510632
                                                                                                                                                                                                              • Opcode ID: fd5a5e364699ce4a0fdc81f4504cbf464797e88720b1db6411780ffb4476f92d
                                                                                                                                                                                                              • Instruction ID: 02eb9736952d2a2b4b7c1167389122037410bde8fc9acd6e29a5ba8690f26e1d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd5a5e364699ce4a0fdc81f4504cbf464797e88720b1db6411780ffb4476f92d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6111E7B55001085BC720DF64DC41EBB737CEB44308F04857EFE05A2282E639E9558B69
                                                                                                                                                                                                              Function 00405070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 0040508F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 004050A2
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004050AB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-pid$d1ff3a37
                                                                                                                                                                                                              • API String ID: 3057366584-1933064289
                                                                                                                                                                                                              • Opcode ID: ff6920a4f34576960947fc1b5a3d0ac86d7dd6ac261b0cca6cf284f5e966243f
                                                                                                                                                                                                              • Instruction ID: 655e5f0feb57342864bd118bf9991db32f12074da84674c84bcde0045b314480
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ff6920a4f34576960947fc1b5a3d0ac86d7dd6ac261b0cca6cf284f5e966243f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9F052F0A4030467EB20A7B09C8BFDB3218D310711F10067BF714B22E0E9F88AC08AAD
                                                                                                                                                                                                              Function 0040D530 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 121sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0040D5E4
                                                                                                                                                                                                                • Part of subcall function 00408F50: ApplyControlToken.SECUR32(?,?), ref: 00408FB5
                                                                                                                                                                                                                • Part of subcall function 00408F50: InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00408FF9
                                                                                                                                                                                                                • Part of subcall function 00408F50: DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00409025
                                                                                                                                                                                                                • Part of subcall function 00408F50: FreeCredentialsHandle.SECUR32(?), ref: 0040902F
                                                                                                                                                                                                              • Sleep.KERNEL32(0000000F), ref: 0040D659
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ContextSecuritySleep$ApplyControlCredentialsDeleteFreeHandleInitializeToken
                                                                                                                                                                                                              • String ID: %s:%d$cnc$VA
                                                                                                                                                                                                              • API String ID: 3241915987-2824176248
                                                                                                                                                                                                              • Opcode ID: 40b7a7b7b26b7a287c0fe2023fb64aff6b8fa03e17e4370fc5b3c4fb5ae0aa8e
                                                                                                                                                                                                              • Instruction ID: 3fba86e59980fe9d4d7b2036a9b00bfb261980af2cf933dbcae5c76902665172
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 40b7a7b7b26b7a287c0fe2023fb64aff6b8fa03e17e4370fc5b3c4fb5ae0aa8e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6C41D6B5E00104EBC710EBD9DC819AEB3B9EB84318F14457AFD09E7391DA35ED0487A9
                                                                                                                                                                                                              Function 004016F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstr$lstrcmp
                                                                                                                                                                                                              • String ID: bdns$block
                                                                                                                                                                                                              • API String ID: 142677638-4143068083
                                                                                                                                                                                                              • Opcode ID: 7e7ddd14c0000a22ba27eb4ad8a06dc852e173b9f06dd4947da55ca17d1bf46e
                                                                                                                                                                                                              • Instruction ID: 124088c1a3f70e1cbae084184767cd66ed6bf528bf03336b987e05220ac7cc48
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7e7ddd14c0000a22ba27eb4ad8a06dc852e173b9f06dd4947da55ca17d1bf46e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9121B0766012086BDB10DF49AC85EFB736CDB88711F14812BFD05E3291E778ED5186BA
                                                                                                                                                                                                              Function 00407E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103A), ref: 00407E2C
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00407E63
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00407E7A
                                                                                                                                                                                                              • connect.WS2_32(?,00000008,00000010), ref: 00407E8B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocLocalconnectioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3721573447-0
                                                                                                                                                                                                              • Opcode ID: 6a0cf34466a604d09193a111f7b2e156c19cd74b9b825a2281b43bf372efd1ff
                                                                                                                                                                                                              • Instruction ID: 8573ccf17625dbd4e70cb95bd4ecb179e2b8f2d801530163547a45014eaf0546
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a0cf34466a604d09193a111f7b2e156c19cd74b9b825a2281b43bf372efd1ff
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E811D631A00304ABC720DF59D805AD6B7A8DB49724F00469AFA59DB3D1D2B169908794
                                                                                                                                                                                                              Function 0040E770 Relevance: 7.6, APIs: 5, Instructions: 50registrystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0040E77C
                                                                                                                                                                                                              • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000012,?), ref: 0040E793
                                                                                                                                                                                                              • RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 0040E7B5
                                                                                                                                                                                                              • RegNotifyChangeKeyValue.ADVAPI32 ref: 0040E7C3
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040E7D1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ChangeCloseNotifyOpenlstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2592630252-0
                                                                                                                                                                                                              • Opcode ID: af4cde93d3db90eb8642d8f6f32dd5aa766a189061079ea768f5a47468b3961d
                                                                                                                                                                                                              • Instruction ID: 817f0236f2bd820b7f614add4cf1e09f77a3d0cd335360597150fdbb8a11f275
                                                                                                                                                                                                              • Opcode Fuzzy Hash: af4cde93d3db90eb8642d8f6f32dd5aa766a189061079ea768f5a47468b3961d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BF011A75740304BFE720CF65DC89F977BACEB88B50F10C429BB499B690D674E8408B68
                                                                                                                                                                                                              Function 00407700 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                                • Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
                                                                                                                                                                                                                • Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,00411A30), ref: 0040777F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexObjectReleaseSingleWait_snprintflstrcmplstrlenmemset
                                                                                                                                                                                                              • String ID: state_%s
                                                                                                                                                                                                              • API String ID: 1716770999-3670522127
                                                                                                                                                                                                              • Opcode ID: ab5105bdc72a913e38c48e055f54140b59f6612a3db0fc3fa5d1ff914c552933
                                                                                                                                                                                                              • Instruction ID: 2cd1af118f2aaba9ee0144bd5bb7b35bf02337a9ecf34d3b98cb7566c03369e6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ab5105bdc72a913e38c48e055f54140b59f6612a3db0fc3fa5d1ff914c552933
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C01DBF5A903087BDB10F7A4DE0BFF9736C9B44704F0045E9B719A2082F5B46A448799
                                                                                                                                                                                                              Function 0040D760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                              • Sleep.KERNEL32(00001388), ref: 0040D78A
                                                                                                                                                                                                              • Sleep.KERNEL32(00002710), ref: 0040D795
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0040D799
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Sleep$ExitProcess_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: bsod
                                                                                                                                                                                                              • API String ID: 706155222-1315366068
                                                                                                                                                                                                              • Opcode ID: 5388deed1a02275c41a8fd53f22eb3b9fef4c2e063f1b81cc4663499f754aae8
                                                                                                                                                                                                              • Instruction ID: 29af33aa6d3d1f262d87ea6fb0a6dfe9123b99fa97d7c71365f1f2103470005d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5388deed1a02275c41a8fd53f22eb3b9fef4c2e063f1b81cc4663499f754aae8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77D05E71D84230A3D22123A56C0AF8B59209F40F61F164232EA05BB5E0C5A8298684EE
                                                                                                                                                                                                              Function 0040E840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00407330: memset.MSVCRT ref: 00407351
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
                                                                                                                                                                                                                • Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
                                                                                                                                                                                                                • Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 0040E861
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040E868
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: admin$isadmin
                                                                                                                                                                                                              • API String ID: 3136305548-1977506819
                                                                                                                                                                                                              • Opcode ID: 852f46d075f3d37bcd2cc98b227bbc4443c41ac42a61e9d4ddf9bd417a26fa24
                                                                                                                                                                                                              • Instruction ID: 3b6143c26c68504e08692baad0537c2f2dacd248f620d2e63fa73881cbd2d311
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 852f46d075f3d37bcd2cc98b227bbc4443c41ac42a61e9d4ddf9bd417a26fa24
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 66D0E975BD5340B6F56027A05E0FF4965545728F06F208432BB05F91D1E6E8709455AD
                                                                                                                                                                                                              Function 00402880 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
                                                                                                                                                                                                                • Part of subcall function 00402460: HeapAlloc.KERNEL32(00600000,00000008,004020DE,?,004020DE,?), ref: 0040247E
                                                                                                                                                                                                              • inet_addr.WS2_32(00000001), ref: 004028BE
                                                                                                                                                                                                              • DnsQuery_A.DNSAPI(00000001,00000001,00000008,00000000,00000001,00000000), ref: 00402939
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,00000001,00000001,?,00000000,00000001,00000006), ref: 0040294E
                                                                                                                                                                                                              • DnsFree.DNSAPI(00000001,00000001), ref: 004029D9
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeProcessQuery__stricmpinet_addr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3002912770-0
                                                                                                                                                                                                              • Opcode ID: a5b975686055a6ad762db3198c48b653122c65071bde79865f0daa47f409934a
                                                                                                                                                                                                              • Instruction ID: 7b4bcac95eda314589689d5efbf7f5d85f6b8a6c39ee2f63de8762e6eb4cb817
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a5b975686055a6ad762db3198c48b653122c65071bde79865f0daa47f409934a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 865190B07002049FD720DF69CA89B6AB3A5AF85704F20447EE585AB3C0E7B9AD41CB95
                                                                                                                                                                                                              Function 00408F50 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ApplyControlToken.SECUR32(?,?), ref: 00408FB5
                                                                                                                                                                                                              • InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00408FF9
                                                                                                                                                                                                              • DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00409025
                                                                                                                                                                                                              • FreeCredentialsHandle.SECUR32(?), ref: 0040902F
                                                                                                                                                                                                                • Part of subcall function 00408760: FreeContextBuffer.SECUR32(?), ref: 00408774
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Context$FreeSecurity$ApplyBufferControlCredentialsDeleteHandleInitializeToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 362823901-0
                                                                                                                                                                                                              • Opcode ID: 2380779ca4936bf24da35008e120283aa08c8bc45cf506c596155f6e4fe055a8
                                                                                                                                                                                                              • Instruction ID: 597c2a7369eb59e50f1a6720c39724f21d20c383529a429c7ed2b113d5fceb98
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2380779ca4936bf24da35008e120283aa08c8bc45cf506c596155f6e4fe055a8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3141D9B1C002099BCB10DF9AC9859EEFBFCFF98304F10851EE515B3251D7B9A9448B64
                                                                                                                                                                                                              Function 00404900 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(-0000FFFF,?,00407495), ref: 004049A5
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(00407495,?,00407495), ref: 004049D1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexRelease$ObjectSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 257779224-0
                                                                                                                                                                                                              • Opcode ID: 63b75c3b539f6d5a62ae21cdc0f351efb8da632d2bdbb001c1f598c76031e3ef
                                                                                                                                                                                                              • Instruction ID: 60a01da9d8e12490b98d0435c3672651bd769e7b273c693051a5ec76faa180d4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 63b75c3b539f6d5a62ae21cdc0f351efb8da632d2bdbb001c1f598c76031e3ef
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A2151F12012068BDB209F75E844BA777A9EFC4364B19457BEB88D7290D738DC51CB94
                                                                                                                                                                                                              Function 004049F0 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,004073CC,00437C98,00000000,00000000,00000010,00000000), ref: 00404A10
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00404A77
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,?,00000000), ref: 00404AA9
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,00000000), ref: 00404ABC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexRelease$ObjectSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 257779224-0
                                                                                                                                                                                                              • Opcode ID: 63d3ffe026840b187cbe0a3bca9a3e1a2581093c4aa0e4f7d61f639895044d6a
                                                                                                                                                                                                              • Instruction ID: 9de7bc225a4f11a468762aa64ff5b90ab43fa89967ea14f2f024b3cc108ef4f2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 63d3ffe026840b187cbe0a3bca9a3e1a2581093c4aa0e4f7d61f639895044d6a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A2182B23041055BDB10DE69EC80AAB73A9AFC0754715453BFE48A7390E738ED418AAC
                                                                                                                                                                                                              Function 004011C0 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 004011E1
                                                                                                                                                                                                              • GetFileAttributesA.KERNEL32(?), ref: 00401201
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00401241
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00401261
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AttributesByteCharExitFileMultiThreadWidememset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1389112251-0
                                                                                                                                                                                                              • Opcode ID: cfbad574c948d1266362059a41731fcce01fb21d38de471cc28d149e49a8243d
                                                                                                                                                                                                              • Instruction ID: 9c09465909980defebf6fc1bf24d1c266cb80464f9af9b5b5def457f6c2ce4cf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cfbad574c948d1266362059a41731fcce01fb21d38de471cc28d149e49a8243d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0215E76200208BBDB10DF55EC49FEB7778EB89711F004269FE19A3291DB34AD51CBA9
                                                                                                                                                                                                              Function 0040D6B0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 0040D6FD
                                                                                                                                                                                                              • RegSetValueExW.ADVAPI32 ref: 0040D731
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040D740
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040D753
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Close$CreateValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1009429713-0
                                                                                                                                                                                                              • Opcode ID: 023a06ccce26f21a6eb4b1cf29a7a46dec0311a4eb8ff73b697b9a0322046531
                                                                                                                                                                                                              • Instruction ID: 4ebeea118ffc0b70507ed0453d9bb896cfbcfcc1ebea939967c067b9dbd2b579
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 023a06ccce26f21a6eb4b1cf29a7a46dec0311a4eb8ff73b697b9a0322046531
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80216075B40209BBDB14CF94DC46FAB7778EB88B44F108154FA05AB2D4E6B4FA049BA4
                                                                                                                                                                                                              Function 00407EF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeLocal$closesocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1824021853-0
                                                                                                                                                                                                              • Opcode ID: 0d7af23abec9eedd371e7df087b943542a0927854f9a33720e7b197f5bd49994
                                                                                                                                                                                                              • Instruction ID: 58c757484c17e8af9c5a96bfa26f79bf23742db81f14522f08cab0e5839f8174
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0d7af23abec9eedd371e7df087b943542a0927854f9a33720e7b197f5bd49994
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46015E32B042109FC721DF59E88499A73A9FF8976531404BAF648DB350C635EC41CBA4
                                                                                                                                                                                                              Function 0040A800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: 5b989edbec9fb57e2c91f01ace7b0e21f16f3518f0f45a2d65738c978c86f70f
                                                                                                                                                                                                              • Instruction ID: 12bd840c873a94c867595e1b095c0c34b8311daa37525659d88b801d5309ee5b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b989edbec9fb57e2c91f01ace7b0e21f16f3518f0f45a2d65738c978c86f70f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D9F0497720030067D310B666DC87ECA739ECBC8366F00843AFA0997381E9BDDD4242BA
                                                                                                                                                                                                              Function 0040A790 Relevance: 6.0, APIs: 4, Instructions: 44stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: a56deda88b7bfe3fcc912b37b26a7d9c041b97cb9979405d9c52ec78308d40e7
                                                                                                                                                                                                              • Instruction ID: 7d5eb4f3d2123dae37af85631522b7622fe4fdd3bec7fbc1b2475d13fce141a8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a56deda88b7bfe3fcc912b37b26a7d9c041b97cb9979405d9c52ec78308d40e7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2DF0467340021167C230A666EC82ACBF79CDB88762F048576FE04AB352E47CDE8581FA
                                                                                                                                                                                                              Function 0040A080 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040A0A2
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0040A0C0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040A0CB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040A0D8
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandle$CreateWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3602564925-0
                                                                                                                                                                                                              • Opcode ID: 468fddb27519cf46e4d5856843bc9a79975d9738623fcc55b54f1ea553afb210
                                                                                                                                                                                                              • Instruction ID: fe0a8d23ea9a6e4fc406740f8b7308c2032c4cdff1c410b5fcd8361f48a0f6c0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 468fddb27519cf46e4d5856843bc9a79975d9738623fcc55b54f1ea553afb210
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FAF0C271240208BBE3209F98EC09FDB77A8EB4D720F008264FF09E72D0D6B06C0087A9
                                                                                                                                                                                                              Function 00410880 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
                                                                                                                                                                                                                • Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,00000000,%s.p10-> Message to %s hijacked!,msn), ref: 004108B1
                                                                                                                                                                                                                • Part of subcall function 00407330: memset.MSVCRT ref: 00407351
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
                                                                                                                                                                                                                • Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
                                                                                                                                                                                                                • Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
                                                                                                                                                                                                                • Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$MutexObjectReleaseSingleWait_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 1310428588-4225137719
                                                                                                                                                                                                              • Opcode ID: 519f8c9fdf63c7c1f49b641e1a4a40017a0203f4e4ef3a6fd24bd5303183ff70
                                                                                                                                                                                                              • Instruction ID: 55a3b949f430f830e01e55d8eab2ca20a34dc41e3933f8760a51994ad7eb43cc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 519f8c9fdf63c7c1f49b641e1a4a40017a0203f4e4ef3a6fd24bd5303183ff70
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 86F08972B451183AE6206699AC02FEF764CC741765F540167FD08F6241D9A9595043E9
                                                                                                                                                                                                              Function 00410820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
                                                                                                                                                                                                                • Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,00402696), ref: 0041084B
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
                                                                                                                                                                                                                • Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
                                                                                                                                                                                                                • Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
                                                                                                                                                                                                                • Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
                                                                                                                                                                                                                • Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 3682388603-4225137719
                                                                                                                                                                                                              • Opcode ID: cd2e5ab03e999fd462f644ac95d6ffc23b58fba4058bfc23253456729c482e8e
                                                                                                                                                                                                              • Instruction ID: b1f1ffa5900155dcc42b295b321ae9a5a6157eb97c0d41748f96ae968a92bafe
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cd2e5ab03e999fd462f644ac95d6ffc23b58fba4058bfc23253456729c482e8e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1F0A772A9512C3AE6207AA5AC02FFB724CCB06755F5001A7FD08F62C1E9E96A5002ED
                                                                                                                                                                                                              Function 0040B990 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040B9AF
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0044A6C8,?,?,00000000), ref: 0040B9BC
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,?,00000000), ref: 0040B9D1
                                                                                                                                                                                                                • Part of subcall function 00408B30: memset.MSVCRT ref: 00408B6E
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0044A6C8,?,?,?,?,?,00000000), ref: 0040B9F2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemset$EnterLeavewvsprintf
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2410102678-0
                                                                                                                                                                                                              • Opcode ID: c44dcdc95ab37f5509346a4a2e4a01478fcd6070543a7a9356c3328c719edfed
                                                                                                                                                                                                              • Instruction ID: ab1e4383a872c048331199a66424550a9576d0d37af5aa461a589b4671dfd121
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c44dcdc95ab37f5509346a4a2e4a01478fcd6070543a7a9356c3328c719edfed
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 01F0F6B59402086BD710AB54DC0AFEA772CAF08708F0481AAFF0CA2240E6746A058BA9
                                                                                                                                                                                                              Function 0040E990 Relevance: 6.0, APIs: 4, Instructions: 31sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000DD20,00000000,00000000,00000000), ref: 0040E9BF
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040E9C6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040E9C9
                                                                                                                                                                                                              • Sleep.KERNEL32(0000EA60), ref: 0040E9D4
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleObjectSingleSleepThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 422747524-0
                                                                                                                                                                                                              • Opcode ID: 3520d3d245d61c6a96fe7d34961e73b05a6290d1859ec47a15f0ff463571a8f1
                                                                                                                                                                                                              • Instruction ID: 6016fdcd02b56c02497e5fa25d12d1976c48136526c7fd933aa435f2e59fedad
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3520d3d245d61c6a96fe7d34961e73b05a6290d1859ec47a15f0ff463571a8f1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 04F0E531641211BBE3205749AC46FDB7358EB49721F218432F300AA2F0C2B469808AAD
                                                                                                                                                                                                              Function 00402570 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 0040257D
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • pdef, xrefs: 00402587
                                                                                                                                                                                                              • %s.Blocked "%S" from moving our bot file, xrefs: 004025A3
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 00402577
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$CriticalSection_snprintfsprintf$CreateEnterFileLeave_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s.Blocked "%S" from moving our bot file$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$pdef
                                                                                                                                                                                                              • API String ID: 3823578686-3599502629
                                                                                                                                                                                                              • Opcode ID: e1ebca6bf7e866b8b4c40c55aa985418e8f8493c40bcf86245e877e238a2602a
                                                                                                                                                                                                              • Instruction ID: 649286052d42560298f9ed5d802204719bd133d8c96d757be806be4a8a8657cd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e1ebca6bf7e866b8b4c40c55aa985418e8f8493c40bcf86245e877e238a2602a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E8E09276B90224B7E6106784BD06FDB771CAB21766B114033FE55E22C1D1AAE9A043AF
                                                                                                                                                                                                              Function 00402510 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 0040251D
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 00402517
                                                                                                                                                                                                              • pdef, xrefs: 00402527
                                                                                                                                                                                                              • %s.Blocked "%s" from moving our bot file, xrefs: 00402543
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$CriticalSection_snprintfsprintf$CreateEnterFileLeave_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s.Blocked "%s" from moving our bot file$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$pdef
                                                                                                                                                                                                              • API String ID: 3823578686-1294415114
                                                                                                                                                                                                              • Opcode ID: ccdd0763f83fa5528f4a4c871e5f7084cdd6c96559e9f58a190258550f238a58
                                                                                                                                                                                                              • Instruction ID: 942cfbfcef8f32ad0d94a38b05ed70c4f3b0f74747a624fa09f8d6a48a98eec9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ccdd0763f83fa5528f4a4c871e5f7084cdd6c96559e9f58a190258550f238a58
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44E09233B9022477D6007788BD46FDB774CAB29766B104033FA05F2281D1BAE9A143AF
                                                                                                                                                                                                              Function 00401620 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 28stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 0040162D
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • pdef, xrefs: 00401637
                                                                                                                                                                                                              • %s.Blocked "%S" from removing our bot file!, xrefs: 00401653
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 00401627
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$CriticalSection_snprintfsprintf$CreateEnterFileLeave_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s.Blocked "%S" from removing our bot file!$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$pdef
                                                                                                                                                                                                              • API String ID: 3823578686-3146994909
                                                                                                                                                                                                              • Opcode ID: 3d6dce3f433fcca8695e55532dece6dd50f82cbf213eb1dd42906ba439d2cd19
                                                                                                                                                                                                              • Instruction ID: d54965355834dd0244b554a7400495693272f9b1ee935826b036bc331b31db14
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3d6dce3f433fcca8695e55532dece6dd50f82cbf213eb1dd42906ba439d2cd19
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13E0DF72B80228B3E61023947C06FCB730C9B21766B140033FA09F2691D1AFE4A082EF
                                                                                                                                                                                                              Function 004015C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 28stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe), ref: 004015CD
                                                                                                                                                                                                                • Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
                                                                                                                                                                                                                • Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
                                                                                                                                                                                                                • Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
                                                                                                                                                                                                                • Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
                                                                                                                                                                                                                • Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
                                                                                                                                                                                                                • Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
                                                                                                                                                                                                                • Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
                                                                                                                                                                                                                • Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
                                                                                                                                                                                                                • Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
                                                                                                                                                                                                                • Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
                                                                                                                                                                                                                • Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • %s.Blocked "%s" from removing our bot file!, xrefs: 004015F3
                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe, xrefs: 004015C7
                                                                                                                                                                                                              • pdef, xrefs: 004015D7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$CriticalSection_snprintfsprintf$CreateEnterFileLeave_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s.Blocked "%s" from removing our bot file!$C:\Users\user\AppData\Roaming\Microsoft\Hxfgfn.exe$pdef
                                                                                                                                                                                                              • API String ID: 3823578686-3726217984
                                                                                                                                                                                                              • Opcode ID: 5f2d8b34a3008d5922b882bfa8d0a7b3246ed5c653d34ea197bf9f8089d27234
                                                                                                                                                                                                              • Instruction ID: 5b77791b84213faf31989625e12510cb53acc8be4dfa8fe7404b0c7ee8473aba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5f2d8b34a3008d5922b882bfa8d0a7b3246ed5c653d34ea197bf9f8089d27234
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28E0D872B9021473D30027C47C42FCBB30C9B257A6B144033FA05B2191D17EA4A042EF
                                                                                                                                                                                                              Function 0040BA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0040BA1E
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,00000000,00000000), ref: 0040BA42
                                                                                                                                                                                                                • Part of subcall function 0040B990: memset.MSVCRT ref: 0040B9AF
                                                                                                                                                                                                                • Part of subcall function 0040B990: EnterCriticalSection.KERNEL32(0044A6C8,?,?,00000000), ref: 0040B9BC
                                                                                                                                                                                                                • Part of subcall function 0040B990: wvsprintfA.USER32(00000000,?,00000000), ref: 0040B9D1
                                                                                                                                                                                                                • Part of subcall function 0040B990: LeaveCriticalSection.KERNEL32(0044A6C8,?,?,?,?,?,00000000), ref: 0040B9F2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemsetwvsprintf$EnterLeave
                                                                                                                                                                                                              • String ID: PPPPMSG %s :%s
                                                                                                                                                                                                              • API String ID: 3980427996-569775469
                                                                                                                                                                                                              • Opcode ID: 0f78ab53ce473f85b064bdd242f857d018326dec87c73b870b25c70050e2c792
                                                                                                                                                                                                              • Instruction ID: 5b1b2f56d9f05309dbd408ca821aabdc91fdf399698cc66cc28d17444b118fdb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0f78ab53ce473f85b064bdd242f857d018326dec87c73b870b25c70050e2c792
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6AF096B5900209ABDB10EB54DC45FE67378FB44704F0081AAB90857281FB74AA488FD9
                                                                                                                                                                                                              Function 00409300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.370688459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000437000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.0000000000449000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.370688459.000000000044C000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_400000_Hwacaj.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: gethostbynameinet_addr
                                                                                                                                                                                                              • String ID: n"@
                                                                                                                                                                                                              • API String ID: 1594361348-1818638472
                                                                                                                                                                                                              • Opcode ID: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
                                                                                                                                                                                                              • Instruction ID: ae33d40cb3c9f804d6ae86217e78cba11e3a34fd54cb6a107b73e1e2973193cc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7DD05B316006145BC910A66AE4418DA739CDE4E3787044157FE1CD77E3C775AC8046D9

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:3.9%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                              Total number of Nodes:405
                                                                                                                                                                                                              Total number of Limit Nodes:15
                                                                                                                                                                                                              execution_graph 5127 5e22160 5128 5e221f4 HttpSendRequestW 5127->5128 5129 5e2217b 5127->5129 5129->5128 5130 5e22185 5129->5130 5143 5e2ac00 HeapAlloc 5130->5143 5132 5e2218e 5133 5e221d4 5132->5133 5152 5e22460 5132->5152 5134 5e221e7 5133->5134 5135 5e221de ??3@YAXPAX 5133->5135 5134->5128 5193 5e224a0 5134->5193 5135->5134 5139 5e2219e 5139->5133 5155 5e2acd0 memset HeapAlloc 5139->5155 5144 5e2ac26 HttpQueryInfoW 5143->5144 5145 5e2ac9f 5143->5145 5146 5e2ac44 GetLastError 5144->5146 5147 5e2ac4f HeapReAlloc 5144->5147 5145->5132 5146->5147 5148 5e2ac8f HeapFree 5146->5148 5147->5145 5149 5e2ac6a HttpQueryInfoW 5147->5149 5148->5145 5149->5148 5150 5e2ac7f lstrcmpW 5149->5150 5150->5148 5151 5e2aca8 HeapFree 5150->5151 5151->5132 5153 5e22477 HeapAlloc 5152->5153 5154 5e2246c GetProcessHeap 5152->5154 5153->5139 5154->5153 5156 5e2adc7 5155->5156 5157 5e2ad1a InternetQueryOptionW 5155->5157 5161 5e221c0 5156->5161 5162 5e2addd HeapFree 5156->5162 5158 5e2ad40 HeapReAlloc 5157->5158 5159 5e2ad31 GetLastError 5157->5159 5158->5156 5160 5e2ad5b InternetQueryOptionW 5158->5160 5159->5156 5159->5158 5160->5156 5163 5e2ad69 WideCharToMultiByte 5160->5163 5161->5133 5168 5e27c00 5161->5168 5162->5161 5163->5156 5164 5e2ad8c 5163->5164 5164->5156 5165 5e2ad92 ??2@YAPAXI 5164->5165 5198 5e235f0 5165->5198 5169 5e27e1a 5168->5169 5170 5e27c21 5168->5170 5169->5133 5170->5169 5171 5e27c4b 5170->5171 5200 5e27700 memset _snprintf lstrlenA 5170->5200 5177 5e27cff 5171->5177 5205 5e2b290 5171->5205 5175 5e27e01 ??3@YAXPAX 5176 5e27e0a 5175->5176 5176->5169 5178 5e27e11 ??3@YAXPAX 5176->5178 5177->5175 5177->5176 5178->5169 5179 5e27c72 5179->5177 5180 5e2ae00 23 API calls 5179->5180 5181 5e27d04 5179->5181 5180->5179 5210 5e273e0 memset memset 5181->5210 5183 5e27d20 5183->5177 5221 5e27330 memset 5183->5221 5186 5e27dd3 5188 5e2a310 18 API calls 5186->5188 5187 5e27d64 _stricmp 5187->5186 5189 5e27d7d _stricmp 5187->5189 5188->5177 5189->5186 5190 5e27d96 _stricmp 5189->5190 5190->5186 5191 5e27daf 5190->5191 5227 5e2a310 5191->5227 5194 5e224ab 5193->5194 5195 5e221f1 5193->5195 5196 5e224b4 GetProcessHeap 5194->5196 5197 5e224bf HeapFree 5194->5197 5195->5128 5196->5197 5197->5195 5199 5e235fb lstrcpyA 5198->5199 5199->5156 5236 5e24900 5200->5236 5202 5e27766 5203 5e2776d 5202->5203 5204 5e27779 lstrcmpA 5202->5204 5203->5171 5204->5171 5206 5e2b2a2 5205->5206 5207 5e27c5c strstr 5206->5207 5208 5e2b2b4 isxdigit 5206->5208 5207->5177 5207->5179 5208->5206 5209 5e2b2c6 isxdigit 5208->5209 5209->5206 5211 5e27453 _vsnprintf lstrlenA 5210->5211 5212 5e27430 lstrlenA 5210->5212 5214 5e24900 8 API calls 5211->5214 5212->5211 5213 5e27437 _snprintf 5212->5213 5213->5211 5215 5e27495 5214->5215 5216 5e274a8 _memicmp 5215->5216 5217 5e2749c 5215->5217 5218 5e274eb 5216->5218 5219 5e274bc _vsnprintf 5216->5219 5217->5183 5218->5183 5220 5e2a310 18 API calls 5219->5220 5220->5218 5222 5e2738b _vsnprintf lstrlenA 5221->5222 5223 5e27368 lstrlenA 5221->5223 5257 5e249f0 5222->5257 5223->5222 5224 5e2736f _snprintf 5223->5224 5224->5222 5226 5e273cc _stricmp 5226->5186 5226->5187 5291 5e30f10 5227->5291 5232 5e2a419 5233 5e2a431 EnterCriticalSection CreateFileA 5232->5233 5234 5e2a473 WriteFile CloseHandle Sleep LeaveCriticalSection 5233->5234 5235 5e2a45f LeaveCriticalSection 5233->5235 5234->5177 5235->5177 5237 5e249df 5236->5237 5239 5e24910 5236->5239 5237->5202 5238 5e24933 WaitForSingleObject 5240 5e24982 5238->5240 5243 5e24943 5238->5243 5239->5237 5239->5238 5240->5202 5241 5e24979 ReleaseMutex 5241->5240 5242 5e24470 _snprintf OpenFileMappingA MapViewOfFile CloseHandle 5242->5243 5243->5240 5243->5241 5243->5242 5244 5e249b2 5243->5244 5246 5e249a2 ReleaseMutex 5243->5246 5251 5e24470 5244->5251 5246->5202 5247 5e249b7 5248 5e24470 4 API calls 5247->5248 5249 5e249c1 ReleaseMutex 5248->5249 5249->5202 5252 5e24536 5251->5252 5253 5e2448e _snprintf OpenFileMappingA 5251->5253 5252->5247 5254 5e244e2 MapViewOfFile 5253->5254 5255 5e24530 5253->5255 5254->5252 5256 5e24516 CloseHandle 5254->5256 5255->5247 5256->5255 5258 5e24a00 5257->5258 5259 5e24acb 5257->5259 5258->5259 5260 5e24a0b WaitForSingleObject 5258->5260 5259->5226 5260->5259 5261 5e24a1e 5260->5261 5275 5e24560 5261->5275 5263 5e24a79 5263->5226 5264 5e24aad ReleaseMutex 5269 5e24470 4 API calls 5264->5269 5265 5e24a42 5265->5263 5265->5264 5283 5e247c0 5265->5283 5268 5e24a6d 5270 5e24a80 5268->5270 5271 5e24a74 ReleaseMutex 5268->5271 5272 5e24ac6 5269->5272 5273 5e24470 4 API calls 5270->5273 5271->5263 5272->5226 5274 5e24a88 ReleaseMutex 5273->5274 5274->5264 5276 5e2457a 5275->5276 5277 5e24470 4 API calls 5276->5277 5278 5e246fd 5276->5278 5279 5e245b9 _snprintf 5276->5279 5280 5e245ed CreateFileMappingA 5276->5280 5277->5276 5278->5265 5279->5276 5279->5280 5280->5278 5281 5e24621 MapViewOfFile 5280->5281 5281->5276 5282 5e24706 CloseHandle 5281->5282 5282->5265 5284 5e24875 5283->5284 5285 5e247d1 5283->5285 5284->5268 5285->5284 5286 5e247ed InterlockedIncrement 5285->5286 5289 5e24807 5286->5289 5287 5e2485c 5287->5268 5288 5e24560 8 API calls 5288->5289 5289->5287 5289->5288 5290 5e24470 _snprintf OpenFileMappingA MapViewOfFile CloseHandle 5289->5290 5290->5289 5292 5e2a31d 6 API calls 5291->5292 5293 5e21e60 5292->5293 5294 5e21e6f _snprintf lstrlenA sprintf lstrlenA lstrlenA 5293->5294 5294->5232 5295 5e25040 5296 5e25060 5295->5296 5297 5e2504c 5295->5297 5297->5296 5299 5e24e90 5297->5299 5300 5e25031 5299->5300 5301 5e24ea2 5299->5301 5300->5296 5301->5300 5302 5e24fa8 5301->5302 5308 5e23750 5301->5308 5312 5e23440 5301->5312 5331 5e22f90 5301->5331 5342 5e26080 5302->5342 5309 5e23760 LdrGetProcedureAddress 5308->5309 5310 5e23784 LdrGetProcedureAddress 5308->5310 5309->5301 5310->5301 5313 5e2359f 5312->5313 5317 5e23451 5312->5317 5313->5301 5314 5e2348c printf printf 5318 5e234c2 5314->5318 5319 5e234c7 printf 5314->5319 5316 5e2355a 5321 5e23593 5316->5321 5354 5e23320 5316->5354 5317->5313 5317->5314 5317->5316 5318->5319 5346 5e235d0 5319->5346 5321->5301 5322 5e234f1 NtAllocateVirtualMemory 5322->5313 5326 5e23500 5322->5326 5326->5313 5347 5e23100 5326->5347 5328 5e2354a 5329 5e23440 6 API calls 5328->5329 5330 5e23551 5329->5330 5330->5301 5332 5e22fa2 5331->5332 5333 5e23074 5331->5333 5332->5333 5334 5e22fc2 ReadProcessMemory 5332->5334 5333->5301 5335 5e22fe0 5334->5335 5341 5e23059 5334->5341 5336 5e23004 WriteProcessMemory 5335->5336 5335->5341 5337 5e23022 5336->5337 5336->5341 5338 5e23028 WriteProcessMemory 5337->5338 5337->5341 5339 5e2303c 5338->5339 5338->5341 5340 5e23044 WriteProcessMemory 5339->5340 5339->5341 5340->5341 5341->5301 5343 5e2608e 5342->5343 5345 5e25022 5342->5345 5344 5e23440 10 API calls 5343->5344 5343->5345 5344->5343 5345->5296 5346->5322 5348 5e23161 5347->5348 5349 5e2310c 5347->5349 5348->5328 5349->5348 5350 5e23123 5349->5350 5351 5e23119 EnterCriticalSection 5349->5351 5352 5e23158 5350->5352 5353 5e2314e LeaveCriticalSection 5350->5353 5351->5350 5352->5328 5353->5352 5355 5e23332 5354->5355 5356 5e23385 5354->5356 5355->5356 5357 5e2333c EnterCriticalSection 5355->5357 5358 5e23346 5355->5358 5360 5e231d0 5356->5360 5357->5358 5358->5356 5359 5e2337b LeaveCriticalSection 5358->5359 5359->5356 5361 5e23230 5360->5361 5362 5e231dc 5360->5362 5361->5321 5362->5361 5363 5e231f3 5362->5363 5364 5e231e9 EnterCriticalSection 5362->5364 5365 5e23227 5363->5365 5366 5e2321d LeaveCriticalSection 5363->5366 5364->5363 5365->5321 5366->5365 5367 5e26640 NtQueryDirectoryFile 5368 5e26686 5367->5368 5374 5e26806 5367->5374 5369 5e266ce wcsstr 5368->5369 5373 5e2674d 5368->5373 5368->5374 5370 5e266e8 5369->5370 5369->5374 5372 5e26737 wcsstr 5370->5372 5370->5374 5371 5e2678e wcsstr 5371->5373 5372->5370 5372->5373 5373->5371 5373->5374 5375 5e25c50 5383 5e25a20 5375->5383 5377 5e25c67 5378 5e25c7f NtQueryInformationProcess 5377->5378 5379 5e25cd8 5378->5379 5380 5e25c8a 5378->5380 5381 5e249f0 13 API calls 5380->5381 5382 5e25cc6 5381->5382 5384 5e25a2b 5383->5384 5392 5e25c46 5384->5392 5400 5e23a20 5384->5400 5386 5e25ae5 5405 5e24d00 5386->5405 5388 5e25aef LdrEnumerateLoadedModules 5432 5e23080 5388->5432 5391 5e25b31 5393 5e23080 9 API calls 5391->5393 5392->5377 5398 5e25b4f 5393->5398 5394 5e25a3c 5394->5386 5394->5392 5397 5e23750 2 API calls 5394->5397 5440 5e23920 5394->5440 5395 5e25bf4 CreateThread CloseHandle 5396 5e25c0c 5395->5396 5396->5392 5399 5e25c2e CreateThread CloseHandle 5396->5399 5397->5394 5398->5395 5398->5396 5399->5392 5402 5e23a25 5400->5402 5401 5e23a2d 5401->5394 5402->5401 5445 5e235b0 GetPEB 5402->5445 5404 5e23a44 5404->5394 5407 5e24d0e 5405->5407 5406 5e24d16 5406->5388 5407->5406 5408 5e23a20 GetPEB 5407->5408 5409 5e24d33 5408->5409 5410 5e24d37 5409->5410 5411 5e24d3d GetVersionExA 5409->5411 5410->5388 5411->5410 5412 5e24d56 5411->5412 5446 5e23f90 5412->5446 5414 5e24d5c 5456 5e23390 5414->5456 5416 5e24d7e 5465 5e24ae0 5416->5465 5418 5e24d9b 5489 5e23ac0 5418->5489 5420 5e24da6 strncpy 5493 5e235d0 5420->5493 5422 5e24dd0 NtQueryInformationProcess 5423 5e24dee 5422->5423 5424 5e24ddc 5422->5424 5494 5e23890 5423->5494 5425 5e23440 10 API calls 5424->5425 5425->5423 5427 5e24e67 5428 5e23750 2 API calls 5427->5428 5429 5e24e6d 5428->5429 5502 5e24c20 5429->5502 5431 5e24e7e 5431->5388 5433 5e23890 3 API calls 5432->5433 5434 5e2308c 5433->5434 5435 5e230bb 5434->5435 5436 5e23750 2 API calls 5434->5436 5435->5391 5437 5e2309a 5436->5437 5437->5435 5438 5e22f90 4 API calls 5437->5438 5439 5e230b6 5438->5439 5439->5391 5526 5e23670 5440->5526 5443 5e23974 LdrLoadDll 5443->5394 5444 5e2396c 5444->5394 5445->5404 5447 5e23f9f 5446->5447 5450 5e23fa6 5446->5450 5448 5e23890 3 API calls 5447->5448 5448->5450 5449 5e24018 5449->5414 5450->5449 5451 5e23890 3 API calls 5450->5451 5452 5e23fd1 5451->5452 5453 5e23750 2 API calls 5452->5453 5454 5e23fd7 5453->5454 5454->5449 5455 5e24003 GetNativeSystemInfo 5454->5455 5455->5449 5457 5e2339b 5456->5457 5458 5e233a0 5456->5458 5457->5416 5511 5e230c0 5458->5511 5461 5e230c0 InitializeCriticalSection 5463 5e233c3 5461->5463 5462 5e2342e 5462->5416 5463->5462 5464 5e231d0 2 API calls 5463->5464 5464->5462 5466 5e24af2 5465->5466 5467 5e24b54 5465->5467 5466->5467 5468 5e24b0d strncpy sprintf CreateMutexA 5466->5468 5467->5418 5469 5e24b4b 5468->5469 5470 5e24b5c _snprintf OpenFileMappingA 5468->5470 5515 5e24880 5469->5515 5472 5e24b96 CloseHandle 5470->5472 5473 5e24b9d 5470->5473 5472->5473 5475 5e24ba1 5473->5475 5476 5e24bb4 5473->5476 5474 5e24b51 5474->5467 5478 5e24560 8 API calls 5475->5478 5477 5e24470 4 API calls 5476->5477 5479 5e24bbc 5477->5479 5480 5e24bad 5478->5480 5481 5e24bda 5479->5481 5482 5e24bc8 5479->5482 5480->5476 5483 5e24bd1 5480->5483 5485 5e24c08 5481->5485 5486 5e24bde WaitForSingleObject 5481->5486 5484 5e24880 3 API calls 5482->5484 5483->5418 5487 5e24bce 5484->5487 5485->5418 5486->5485 5488 5e24bed ReleaseMutex 5486->5488 5487->5483 5488->5485 5490 5e23b10 5489->5490 5491 5e23acc 5489->5491 5490->5420 5491->5490 5492 5e23ae0 _snprintf 5491->5492 5492->5420 5493->5422 5495 5e238a0 5494->5495 5496 5e238ae 5494->5496 5524 5e235b0 GetPEB 5495->5524 5498 5e238c0 RtlAnsiStringToUnicodeString 5496->5498 5500 5e238f6 LdrGetDllHandle 5498->5500 5501 5e238ee 5498->5501 5499 5e238a5 5499->5427 5500->5427 5501->5427 5525 5e235d0 5502->5525 5504 5e24c31 OpenProcessToken 5505 5e24c48 LookupPrivilegeValueA 5504->5505 5506 5e24c3c GetLastError 5504->5506 5507 5e24c72 AdjustTokenPrivileges 5505->5507 5508 5e24c5c GetLastError CloseHandle 5505->5508 5506->5431 5509 5e24ca3 GetLastError 5507->5509 5510 5e24ca9 CloseHandle 5507->5510 5508->5431 5509->5510 5510->5431 5512 5e230f1 5511->5512 5513 5e230cb 5511->5513 5512->5461 5513->5512 5514 5e230e7 InitializeCriticalSection 5513->5514 5514->5512 5516 5e24890 5515->5516 5517 5e2488b 5515->5517 5518 5e24897 CloseHandle 5516->5518 5519 5e248a4 5516->5519 5517->5474 5518->5519 5520 5e248b7 UnmapViewOfFile 5519->5520 5521 5e248cc 5519->5521 5520->5519 5522 5e248da CloseHandle 5521->5522 5523 5e248ef 5521->5523 5522->5521 5523->5474 5524->5499 5525->5504 5527 5e2367c RtlAnsiStringToUnicodeString 5526->5527 5527->5443 5527->5444 5528 5e253d0 NtQueryInformationThread 5529 5e256c7 NtResumeThread 5528->5529 5530 5e253f5 5528->5530 5530->5529 5531 5e25405 OpenProcess 5530->5531 5532 5e256c6 5531->5532 5533 5e2541e NtQueryInformationProcess 5531->5533 5532->5529 5534 5e256bf CloseHandle 5533->5534 5535 5e2543d 5533->5535 5534->5532 5536 5e24900 8 API calls 5535->5536 5537 5e25475 5536->5537 5538 5e256bd 5537->5538 5539 5e249f0 13 API calls 5537->5539 5538->5534 5540 5e25499 5539->5540 5540->5538 5541 5e254a6 InterlockedCompareExchange 5540->5541 5541->5538 5545 5e254bc 5541->5545 5542 5e2550b VirtualAllocEx 5542->5538 5543 5e25540 WriteProcessMemory 5542->5543 5543->5538 5544 5e2555c 5543->5544 5544->5538 5546 5e25565 NtQueryInformationProcess 5544->5546 5545->5538 5545->5542 5546->5538 5547 5e25581 ReadProcessMemory 5546->5547 5547->5538 5548 5e255aa 5547->5548 5548->5538 5549 5e255b3 ReadProcessMemory 5548->5549 5549->5538 5550 5e255ce 5549->5550 5550->5538 5551 5e255d7 ReadProcessMemory 5550->5551 5551->5538 5552 5e255f6 5551->5552 5552->5538 5553 5e255ff ReadProcessMemory 5552->5553 5553->5538 5554 5e25622 5553->5554 5554->5538 5558 5e24160 5554->5558 5556 5e2568c 5556->5538 5557 5e25693 WriteProcessMemory 5556->5557 5557->5538 5573 5e24020 5558->5573 5560 5e2417f VirtualAllocEx 5561 5e241a5 5560->5561 5562 5e2428c 5560->5562 5563 5e24020 2 API calls 5561->5563 5562->5556 5564 5e241b4 5563->5564 5565 5e24270 VirtualFreeEx 5564->5565 5568 5e24241 WriteProcessMemory 5564->5568 5565->5562 5566 5e24286 5565->5566 5578 5e237f0 GetProcessHeap HeapFree 5566->5578 5568->5565 5569 5e24259 5568->5569 5569->5565 5570 5e2425e 5569->5570 5577 5e237f0 GetProcessHeap HeapFree 5570->5577 5572 5e24264 5572->5556 5574 5e24040 5573->5574 5576 5e24046 5573->5576 5579 5e23810 GetProcessHeap HeapAlloc 5574->5579 5576->5560 5577->5572 5578->5562 5579->5576 5580 5e25300 5581 5e25321 5580->5581 5582 5e25386 5581->5582 5583 5e25330 5581->5583 5584 5e25a20 59 API calls 5583->5584 5585 5e2533b GetModuleFileNameW 5584->5585 5586 5e25381 5585->5586 5587 5e25368 5585->5587 5586->5582 5588 5e24e90 16 API calls 5587->5588 5589 5e25379 5588->5589 5591 5e25220 5589->5591 5592 5e25239 5591->5592 5593 5e25240 5591->5593 5592->5586 5593->5592 5594 5e25280 RtlAnsiStringToUnicodeString 5593->5594 5595 5e23890 3 API calls 5593->5595 5596 5e24e90 16 API calls 5593->5596 5597 5e25220 19 API calls 5593->5597 5594->5593 5595->5593 5596->5593 5597->5593

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 05E253D0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 258nativethreadinjectionCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 05E253E7
                                                                                                                                                                                                              • OpenProcess.KERNEL32(0000047A,00000000,?), ref: 05E2540E
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,0000001B,?,00000400,00000000), ref: 05E2542F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E256C0
                                                                                                                                                                                                                • Part of subcall function 05E24900: WaitForSingleObject.KERNEL32(05E27495,000000FF,?,00000000,756F59EB,?,05E27495), ref: 05E24939
                                                                                                                                                                                                                • Part of subcall function 05E24900: ReleaseMutex.KERNEL32(?,?,05E27495), ref: 05E2497C
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 05E254AB
                                                                                                                                                                                                              • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 05E2552F
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 05E2554E
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 05E25573
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 05E255A0
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 05E255C4
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 05E255EC
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 05E25618
                                                                                                                                                                                                                • Part of subcall function 05E24160: VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 05E24192
                                                                                                                                                                                                                • Part of subcall function 05E24160: WriteProcessMemory.KERNEL32 ref: 05E2424F
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 05E256B7
                                                                                                                                                                                                              • NtResumeThread.NTDLL(?,?), ref: 05E256CF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$Memory$Read$InformationQueryWrite$AllocThreadVirtual$CloseCompareExchangeHandleInterlockedMutexObjectOpenReleaseResumeSingleWait
                                                                                                                                                                                                              • String ID: STFU
                                                                                                                                                                                                              • API String ID: 711637985-778810564
                                                                                                                                                                                                              • Opcode ID: 480fac2a2124423cf8dfd9aa307809e61c00ab0c9cee7f6eb6ea9e4e8e86222d
                                                                                                                                                                                                              • Instruction ID: 0a099a328e4c6f0b1aca332e599fc4daa5dbebb9c4bb89bdd842fe1970ad06f0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 480fac2a2124423cf8dfd9aa307809e61c00ab0c9cee7f6eb6ea9e4e8e86222d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 659190B1A00219AFEB10DB95CD85FEE77B8FB84744F108159F941AB244EB70DA41CF60
                                                                                                                                                                                                              Function 05E24C20 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,05E24E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 05E24C32
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E24C3C
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 05E24C52
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E24C5C
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 05E24C66
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1673749002-0
                                                                                                                                                                                                              • Opcode ID: d57bd7c026f65117854815ec1bc643128dae53567b39c18b69e9ab548b90a917
                                                                                                                                                                                                              • Instruction ID: 26d7baf1fc79081a84d6b3436198b17208a18d3c6ed0f1f090474f2d5d850caa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d57bd7c026f65117854815ec1bc643128dae53567b39c18b69e9ab548b90a917
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D0119135A1421CABDB18DFA5D80EFAE7BB8EB08709F00454DFD49D6280DA719900CB61
                                                                                                                                                                                                              Function 05E24D00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 105COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: NtGetNextProcess$SeDebugPrivilege$ntdll.dll
                                                                                                                                                                                                              • API String ID: 0-503679825
                                                                                                                                                                                                              • Opcode ID: 11723466e5272d2b6dfa56b7f0db7d124c5bb3c98a91792ef1f70273c6ccd440
                                                                                                                                                                                                              • Instruction ID: 1354e82044e1ed7936eb3affaca9bf61e27cb4f3a4f79f02f34b2f1a86f27698
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 11723466e5272d2b6dfa56b7f0db7d124c5bb3c98a91792ef1f70273c6ccd440
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C33128B0F5432466E714BB76AC0FF6A7654EF08784F006854FDC897185FEB45550CBA1
                                                                                                                                                                                                              Function 05E26640 Relevance: 6.2, APIs: 4, Instructions: 203filenativeCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 199 5e26640-5e26680 NtQueryDirectoryFile 200 5e26686-5e26689 199->200 201 5e26838 199->201 202 5e2668b-5e2668e 200->202 203 5e266a8-5e266b5 200->203 204 5e2683b-5e26841 201->204 202->203 205 5e26690-5e26693 202->205 206 5e26760-5e2677b call 5e26450 call 5e265c0 203->206 207 5e266bb-5e266e2 call 5e26530 call 5e265c0 wcsstr 203->207 205->203 209 5e26695-5e26698 205->209 219 5e267ed-5e26800 call 5e26450 206->219 220 5e2677d-5e267a5 call 5e26530 call 5e265c0 wcsstr 206->220 207->201 221 5e266e8-5e26727 call 5e24cc0 207->221 209->203 212 5e2669a-5e2669d 209->212 212->203 215 5e2669f-5e266a2 212->215 215->201 215->203 219->206 229 5e26806-5e2680f 219->229 220->219 233 5e267a7-5e267bc call 5e24cc0 220->233 221->204 232 5e2672d-5e2674b call 5e265c0 wcsstr 221->232 232->221 238 5e2674d-5e26756 232->238 239 5e26812-5e26814 233->239 240 5e267be-5e267e8 call 5e26450 * 2 call 5e23640 233->240 238->206 241 5e26816-5e26826 239->241 242 5e26829-5e26835 call 5e264c0 239->242 240->206 242->201
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: wcsstr$DirectoryFileQuery
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 98336418-0
                                                                                                                                                                                                              • Opcode ID: d7f11ad58e5146d9e25e9140b40082ab0df770a88b0fce481de2603daf6c6710
                                                                                                                                                                                                              • Instruction ID: 33b30693eae4e71eb5abe76414df6b78713cbd198a797eb0b4c44c08ff922c8c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d7f11ad58e5146d9e25e9140b40082ab0df770a88b0fce481de2603daf6c6710
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D5185B6A0022867DB14DF59DC88EEF7BACEF89658F055359FC8993204EA30D950C7A1
                                                                                                                                                                                                              Function 05E26612 Relevance: 4.6, APIs: 3, Instructions: 137filenativeCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 267 5e26612-5e26680 NtQueryDirectoryFile 269 5e26686-5e26689 267->269 270 5e26838 267->270 271 5e2668b-5e2668e 269->271 272 5e266a8-5e266b5 269->272 273 5e2683b-5e26841 270->273 271->272 274 5e26690-5e26693 271->274 275 5e26760-5e2677b call 5e26450 call 5e265c0 272->275 276 5e266bb-5e266e2 call 5e26530 call 5e265c0 wcsstr 272->276 274->272 278 5e26695-5e26698 274->278 288 5e267ed-5e26800 call 5e26450 275->288 289 5e2677d-5e267a5 call 5e26530 call 5e265c0 wcsstr 275->289 276->270 290 5e266e8-5e26727 call 5e24cc0 276->290 278->272 281 5e2669a-5e2669d 278->281 281->272 284 5e2669f-5e266a2 281->284 284->270 284->272 288->275 298 5e26806-5e2680f 288->298 289->288 302 5e267a7-5e267bc call 5e24cc0 289->302 290->273 301 5e2672d-5e2674b call 5e265c0 wcsstr 290->301 301->290 307 5e2674d-5e26756 301->307 308 5e26812-5e26814 302->308 309 5e267be-5e267e8 call 5e26450 * 2 call 5e23640 302->309 307->275 310 5e26816-5e26826 308->310 311 5e26829-5e26835 call 5e264c0 308->311 309->275 311->270
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: wcsstr$DirectoryFileQuery
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 98336418-0
                                                                                                                                                                                                              • Opcode ID: a1f988a4a9f5b576a4973679f7544dac60987377afbb28abb4fd09da1a178224
                                                                                                                                                                                                              • Instruction ID: e257bcfacfc39cb25ad6b0b0cdde12cf5c5c2f7775026ca3d811c8f896bc03a5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1f988a4a9f5b576a4973679f7544dac60987377afbb28abb4fd09da1a178224
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC315EB2A002596BDB14DF59CC84DEB7BADEF4D254F055219FD89D3204DA30EC51CBA0
                                                                                                                                                                                                              Function 05E25C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49nativeCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E25A20: LdrEnumerateLoadedModules.NTDLL(00000000,Function_00005040,?), ref: 05E25B0D
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,0000001B,?,00000800,00000000), ref: 05E25C80
                                                                                                                                                                                                                • Part of subcall function 05E249F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,05E273CC,05E57C98,00000000,00000000,00000010,00000000), ref: 05E24A10
                                                                                                                                                                                                                • Part of subcall function 05E249F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 05E24A77
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumerateInformationLoadedModulesMutexObjectProcessQueryReleaseSingleWait
                                                                                                                                                                                                              • String ID: STFU
                                                                                                                                                                                                              • API String ID: 2599885325-778810564
                                                                                                                                                                                                              • Opcode ID: 540babcf07b1be0b79c951e9fef7e23d5f2e58ffd9e7aafea7558b53341cfffe
                                                                                                                                                                                                              • Instruction ID: 6e56a5ae7a22a30152a6637beaa28e49dfd038975d7bff8d27d419324f2f3762
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 540babcf07b1be0b79c951e9fef7e23d5f2e58ffd9e7aafea7558b53341cfffe
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0701D8B1B403186AEB50EBA49C07BAA76ACEB04701F0051A5BAC4E7180FD7099448BE1
                                                                                                                                                                                                              Function 05E24AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111synchronizationstringCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strncpy.MSVCRT ref: 05E24B1A
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E24B2C
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 05E24B3F
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E24B6F
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32 ref: 05E24B85
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E24B97
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 05E24BE3
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 05E24C02
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
                                                                                                                                                                                                              • String ID: %s_0$-%sMutex
                                                                                                                                                                                                              • API String ID: 4144850300-892854768
                                                                                                                                                                                                              • Opcode ID: cf4b1fd98c581588eb5b7e5f420c435c5aa94b9fa42c03be6271da9a7ce52485
                                                                                                                                                                                                              • Instruction ID: 19bf0e38ce21345a9664e48984d81b793672f4285ac22f1c3c857c5f62d2a107
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cf4b1fd98c581588eb5b7e5f420c435c5aa94b9fa42c03be6271da9a7ce52485
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 223178B17043186BEB209F65DC8AFDBB7ECAF80718F044559F9C9D7180EAB1A544CAA0
                                                                                                                                                                                                              Function 05E25A20 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 189threadlibraryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 69 5e25a20-5e25a31 call 5e235e0 72 5e25a37-5e25a3e call 5e23a20 69->72 73 5e25c49-5e25c4c 69->73 72->73 76 5e25a44-5e25a5b 72->76 77 5e25a61-5e25a68 76->77 78 5e25ae5-5e25b4a call 5e24d00 LdrEnumerateLoadedModules call 5e23080 * 2 76->78 77->78 79 5e25a6a-5e25a76 77->79 92 5e25b4f-5e25b63 78->92 79->78 81 5e25a78-5e25a87 call 5e23920 79->81 87 5e25c46-5e25c48 81->87 88 5e25a8d-5e25a97 81->88 87->73 90 5e25a99 88->90 91 5e25a9c-5e25aa0 88->91 90->91 93 5e25aa2-5e25aa5 91->93 94 5e25ad8-5e25ae3 91->94 95 5e25b70-5e25b85 92->95 96 5e25b65-5e25b6c 92->96 99 5e25aaa-5e25aac 93->99 94->78 94->81 97 5e25b87-5e25b8b 95->97 98 5e25bcc-5e25be5 95->98 96->95 100 5e25bc3-5e25bca 97->100 101 5e25b8d-5e25ba7 call 5e239a0 97->101 102 5e25be7-5e25bf2 98->102 103 5e25bf4-5e25c0a CreateThread CloseHandle 98->103 104 5e25ab3 99->104 105 5e25aae-5e25ab1 99->105 100->97 100->98 101->100 115 5e25ba9-5e25bbf 101->115 102->103 108 5e25c0c-5e25c1f 102->108 103->108 106 5e25ab7-5e25ac2 call 5e23750 104->106 105->106 106->87 117 5e25ac8-5e25ad3 106->117 112 5e25c21-5e25c2c 108->112 113 5e25c2e-5e25c44 CreateThread CloseHandle 108->113 112->87 112->113 113->87 115->100 118 5e25aa7 117->118 119 5e25ad5 117->119 118->99 119->94
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LdrEnumerateLoadedModules.NTDLL(00000000,Function_00005040,?), ref: 05E25B0D
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_00005070,00000000,00000000,00000000), ref: 05E25C03
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E25C0A
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_000050F0,00000000,00000000,00000000), ref: 05E25C3D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E25C44
                                                                                                                                                                                                                • Part of subcall function 05E23920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 05E23962
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleStringThread$AnsiEnumerateLoadedModulesUnicode
                                                                                                                                                                                                              • String ID: LdrLoadDll$NtResumeThread$ntdll.dll
                                                                                                                                                                                                              • API String ID: 1691487058-1814628691
                                                                                                                                                                                                              • Opcode ID: 569c205a853ce38bfbef44118f4b2f52e91a9772f7ec47c47d112bc7e8ff2a0c
                                                                                                                                                                                                              • Instruction ID: 7e9ba71c6a5024496bc1123fe3c97f37b86edb31ec742022e3b1a4ae200455c6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 569c205a853ce38bfbef44118f4b2f52e91a9772f7ec47c47d112bc7e8ff2a0c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1461E0B1B403229BEB24DF29CD86F2673A5BF44748F146529E8C6DB249EB70F401CB90
                                                                                                                                                                                                              Function 05E22F90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103injectionCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 173 5e22f90-5e22f9c 174 5e22fa2-5e22fa7 173->174 175 5e23074-5e2307b 173->175 174->175 176 5e22fad-5e22fb2 174->176 176->175 177 5e22fb8-5e22fbc 176->177 177->175 178 5e22fc2-5e22fda ReadProcessMemory 177->178 179 5e22fe0-5e22ff6 call 5e22e40 178->179 180 5e2306b-5e23073 178->180 179->180 183 5e22ff8-5e23020 call 5e22e20 WriteProcessMemory 179->183 183->180 186 5e23022-5e23026 183->186 186->180 187 5e23028-5e2303a WriteProcessMemory 186->187 187->180 188 5e2303c-5e23042 187->188 188->180 189 5e23044-5e23057 WriteProcessMemory 188->189 189->180 190 5e23059-5e2305d 189->190 190->180 191 5e2305f-5e2306a 190->191
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32 ref: 05E22FD2
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 05E2301C
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 05E23036
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32 ref: 05E23053
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MemoryProcess$Write$Read
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2454571318-3916222277
                                                                                                                                                                                                              • Opcode ID: 861756cfb03f1942657f7d458860fd63d42d9f0bbdbe0d039e1f22e684afc7f1
                                                                                                                                                                                                              • Instruction ID: 83949ee62f5af647303022db3606fb9d927106d2ae6144dbefdb1c386c165b31
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 861756cfb03f1942657f7d458860fd63d42d9f0bbdbe0d039e1f22e684afc7f1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4431AFB2A0011DABEF10DE99DC80EFFB37CEB44658F104169E90597148E731AA45DFB2
                                                                                                                                                                                                              Function 05E24470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 192 5e24470-5e24488 193 5e24544-5e2455b 192->193 194 5e2448e-5e244e0 _snprintf OpenFileMappingA 192->194 195 5e244e2-5e24514 MapViewOfFile 194->195 196 5e24530-5e24535 194->196 197 5e24536-5e2453d 195->197 198 5e24516-5e24528 CloseHandle 195->198 197->193 198->196
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E244A7
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32 ref: 05E244BD
                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 05E244F0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 05E2451B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseHandleMappingOpenView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 460513966-1933919280
                                                                                                                                                                                                              • Opcode ID: ef7a07762c2d9e8a6c98ac7341cb69970431640f36ee44c8fa260da298ee8e1f
                                                                                                                                                                                                              • Instruction ID: ab2827963f41943333a0a2b982dfe2f1f4f7769a8794593a11f4aea7de7c5293
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef7a07762c2d9e8a6c98ac7341cb69970431640f36ee44c8fa260da298ee8e1f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D821A4B26507068FE731CF18D98AB72B3E9EB84308F44857CA78687285DB79B460DB40
                                                                                                                                                                                                              Function 05E23F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 251 5e23f90-5e23f9d 252 5e23fab-5e23fb6 call 5e235e0 251->252 253 5e23f9f-5e23fa6 call 5e23890 251->253 258 5e24018-5e2401b 252->258 259 5e23fb8-5e24001 call 5e235e0 call 5e23890 call 5e23750 252->259 253->252 259->258 266 5e24003-5e24012 GetNativeSystemInfo 259->266 266->258
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetNativeSystemInfo.KERNEL32(?,00000000,kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,05E24D5C), ref: 05E24007
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: InfoNativeSystem
                                                                                                                                                                                                              • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                                                              • API String ID: 1721193555-192647395
                                                                                                                                                                                                              • Opcode ID: 046bad44b8d3d82baf4046647f9adf2e359b3f413bd585fdecd684fcca782968
                                                                                                                                                                                                              • Instruction ID: b171168c5eac6818bb903daa90e572e8bf7e8b952bc9cd6ef10c6c8b9b201b42
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 046bad44b8d3d82baf4046647f9adf2e359b3f413bd585fdecd684fcca782968
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D10117B0D083188ADB0CDFAAA90659DBAB4FB08344F04587EE089A2744EB344750CF59
                                                                                                                                                                                                              Function 05E22160 Relevance: 3.1, APIs: 2, Instructions: 77networkCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 335 5e22160-5e22179 336 5e221f4-5e2220e HttpSendRequestW 335->336 337 5e2217b-5e2217e 335->337 337->336 338 5e22180-5e22183 337->338 338->336 339 5e22185-5e22193 call 5e2ac00 338->339 342 5e221d7-5e221dc 339->342 343 5e22195-5e221a5 call 5e22460 339->343 344 5e221e7-5e221e9 342->344 345 5e221de-5e221e4 ??3@YAXPAX@Z 342->345 343->342 349 5e221a7-5e221c5 call 5e22440 call 5e2acd0 343->349 344->336 347 5e221eb-5e221f1 call 5e224a0 344->347 345->344 347->336 349->342 356 5e221c7-5e221d4 call 5e27c00 349->356 356->342
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HttpSendRequestW.WININET(?,?,?,?,?), ref: 05E22202
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 05E2AC1A
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 05E2AC3E
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: GetLastError.KERNEL32 ref: 05E2AC44
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 05E2AC5E
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 05E2AC79
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: lstrcmpW.KERNEL32(POST,00000000), ref: 05E2AC85
                                                                                                                                                                                                                • Part of subcall function 05E2AC00: HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2AC99
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 05E221DF
                                                                                                                                                                                                                • Part of subcall function 05E22460: GetProcessHeap.KERNEL32(?,05E220DE,?), ref: 05E2246C
                                                                                                                                                                                                                • Part of subcall function 05E22460: HeapAlloc.KERNEL32(?,00000008,05E220DE,?,05E220DE,?), ref: 05E2247E
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: memset.MSVCRT ref: 05E2ACF5
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 05E2AD0A
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 05E2AD2B
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: GetLastError.KERNEL32 ref: 05E2AD31
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 05E2AD4F
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 05E2AD63
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 05E2AD80
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: ??2@YAPAXI@Z.MSVCRT ref: 05E2AD93
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: lstrcpyA.KERNEL32(?,00000000), ref: 05E2ADB3
                                                                                                                                                                                                                • Part of subcall function 05E2ACD0: HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2ADE6
                                                                                                                                                                                                                • Part of subcall function 05E27C00: strstr.MSVCRT ref: 05E27C62
                                                                                                                                                                                                                • Part of subcall function 05E27C00: ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 05E27E02
                                                                                                                                                                                                                • Part of subcall function 05E27C00: ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 05E27E12
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Alloc$Query$??3@Http$ErrorFreeInfoInternetLastOption$??2@ByteCharMultiProcessRequestSendWidelstrcmplstrcpymemsetstrstr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3148490729-0
                                                                                                                                                                                                              • Opcode ID: 8bc52640f6d0d542c8b23c64f2a55c5925c76f8559ed6055e38aca6b280f6fe3
                                                                                                                                                                                                              • Instruction ID: a5a8f7d4ec3a8835153b3a191e807789fad70817e6cdc9e68c22f9885014e895
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8bc52640f6d0d542c8b23c64f2a55c5925c76f8559ed6055e38aca6b280f6fe3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA118EBAE00328A7EB20DE569C49DAF776CFF84654F045125FF8993208E630EA54C6E1
                                                                                                                                                                                                              Function 05E25300 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 359 5e25300-5e2531a 360 5e25321-5e25325 359->360 361 5e25386-5e2538b 360->361 362 5e25327-5e25329 360->362 362->361 363 5e2532b-5e2532e 362->363 363->361 364 5e25330-5e25366 call 5e25a20 GetModuleFileNameW 363->364 367 5e25384 364->367 368 5e25368-5e25381 call 5e24e90 call 5e25220 364->368 367->361 368->367
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E25A20: LdrEnumerateLoadedModules.NTDLL(00000000,Function_00005040,?), ref: 05E25B0D
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 05E25357
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumerateFileLoadedModuleModulesName
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1079544278-0
                                                                                                                                                                                                              • Opcode ID: 846568166279baa10905d7e9957c103e168714f6d8ae92825b93669eeccd253a
                                                                                                                                                                                                              • Instruction ID: 5c1047abc54b97b49cf05c10388ede88f5284bfa7c1706c9a0b4dbb69674a075
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 846568166279baa10905d7e9957c103e168714f6d8ae92825b93669eeccd253a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A011E1B9610218ABC714DF58E849DAFB7B9EF98304F00541AFC85D7348EB70E940CBA0

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 05E2B480 Relevance: 66.9, APIs: 28, Strings: 10, Instructions: 363memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2B4A2
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27401
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27419
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E27431
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _snprintf.MSVCRT ref: 05E27449
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _vsnprintf.MSVCRT ref: 05E2746B
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E2747A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,05E31335), ref: 05E2B51A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 05E2B536
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 05E2B550
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,ERR), ref: 05E2B5F5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 05E2B60D
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2B641
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2B650
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004), ref: 05E2B65F
                                                                                                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 05E2B67D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(-00000004,05E32BE4), ref: 05E2B6A8
                                                                                                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 05E2B6C5
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000000), ref: 05E2B719
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 05E2B74A
                                                                                                                                                                                                                • Part of subcall function 05E21BA0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 05E21BC5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 05E2B75B
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 05E2B76E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 05E2B781
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B796
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B7AB
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,05E32C0C), ref: 05E2B7CD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B7FC
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B863
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B878
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,05E32C0C), ref: 05E2B89A
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B8C9
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2B8E0
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 05E2B8F3
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$AllocHeap$lstrcpy$lstrlen$memset$InfoLocaleTime$??3@FileSystemVersion_vsnprintflstrcmpstrstr
                                                                                                                                                                                                              • String ID: 2K3$2K8$<br>$ERR$VIS$[%s{%s%s{%s$admin$http://api.wipmania.com/$isadmin$n%s[%s{%s%s{%s
                                                                                                                                                                                                              • API String ID: 124843797-3058427118
                                                                                                                                                                                                              • Opcode ID: 31127a22ed1b55ce1229fcc131de7a423cbe93c53c2a9e4efd9be3456117e719
                                                                                                                                                                                                              • Instruction ID: b19bccbb62ab56ee01bf4de3feaa317cde61ad2b363962fce5b2a852a619ac16
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 31127a22ed1b55ce1229fcc131de7a423cbe93c53c2a9e4efd9be3456117e719
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75C1B3B1A44315ABE724DF51CC8AFB773BEBB44708F04995CF2C6AA144E6B0E944CB60
                                                                                                                                                                                                              Function 05E21EA0 Relevance: 37.7, APIs: 25, Instructions: 195fileencryptionCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 05E21ECD
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E21EDA
                                                                                                                                                                                                              • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 05E21EF5
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E21EFF
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E21F06
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$AcquireCloseContextCreateCryptFileHandle
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2213256293-0
                                                                                                                                                                                                              • Opcode ID: 650bcd531a5c02cf0fcf54201305cb2a96f472b12056d4e0e18165c3df5257cc
                                                                                                                                                                                                              • Instruction ID: 873902914dc2872ef471f43cbfbc49bc46097e18a972f64198eeab3fed938ca7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 650bcd531a5c02cf0fcf54201305cb2a96f472b12056d4e0e18165c3df5257cc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7519176618218AFD7049FA5EC8DEFEBB78FB48259F00459DFA85D2140DB318901CB60
                                                                                                                                                                                                              Function 05E2F130 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122filestringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F150
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F168
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,?), ref: 05E2F17B
                                                                                                                                                                                                                • Part of subcall function 05E2EDF0: memset.MSVCRT ref: 05E2EE0E
                                                                                                                                                                                                                • Part of subcall function 05E2EDF0: vsprintf.MSVCRT ref: 05E2EE22
                                                                                                                                                                                                                • Part of subcall function 05E2EDF0: PathAppendA.SHLWAPI(?,00000000), ref: 05E2EE35
                                                                                                                                                                                                              • SetCurrentDirectoryA.KERNEL32(?), ref: 05E2F196
                                                                                                                                                                                                              • FindFirstFileA.KERNEL32(?,?), ref: 05E2F1AA
                                                                                                                                                                                                              • CoInitialize.OLE32(00000000), ref: 05E2F1C2
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2F1E1
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 05E2F20C
                                                                                                                                                                                                              • strncmp.MSVCRT ref: 05E2F22E
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2F246
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2F26B
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 05E2F290
                                                                                                                                                                                                              • FindClose.KERNEL32(?), ref: 05E2F29E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Find$Filememset$Next_snprintf$AppendCloseCurrentDirectoryFirstInitializePathlstrcpystrncmpstrstrvsprintf
                                                                                                                                                                                                              • String ID: %s%s$.inf$RECYCLED
                                                                                                                                                                                                              • API String ID: 3870971729-188919753
                                                                                                                                                                                                              • Opcode ID: 23a26b995d99fe11e52860bb15b36a565692b7203bafcbd86c75c45113f9b342
                                                                                                                                                                                                              • Instruction ID: a2793145a5e1ac83ae1ccc521709bdb7b4373b5421c94d22412a93028e159956
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23a26b995d99fe11e52860bb15b36a565692b7203bafcbd86c75c45113f9b342
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0241B776A4422CABDB14DB61DC8EEEF777CEF44704F045598B988A2144EA70AB85CF60
                                                                                                                                                                                                              Function 05E29D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129memoryfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000004), ref: 05E29DA7
                                                                                                                                                                                                              • CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,20000080,00000000), ref: 05E29DD5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocCreateFileVirtual
                                                                                                                                                                                                              • String ID: \\.\PHYSICALDRIVE0
                                                                                                                                                                                                              • API String ID: 1475775534-1557481562
                                                                                                                                                                                                              • Opcode ID: 3f59b54f9bdc2be0eb25718ca206ede2044a53aff8f49fcb1d2e7a17fbb61ec5
                                                                                                                                                                                                              • Instruction ID: 1050fe973727ce38e8c0a99439167e9bc093629379382c93e8e3987bfb4452b5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f59b54f9bdc2be0eb25718ca206ede2044a53aff8f49fcb1d2e7a17fbb61ec5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E031FC7279430876F72055B9AC4BFFB7B5DE784B36F200266FB48E91C0DAA0690086F4
                                                                                                                                                                                                              Function 05E2FB60 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 106windowregistryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterClassExA.USER32 ref: 05E2FC05
                                                                                                                                                                                                              • CreateWindowExA.USER32 ref: 05E2FC20
                                                                                                                                                                                                              • RegisterDeviceNotificationA.USER32(00000000,00000020,00000000), ref: 05E2FC30
                                                                                                                                                                                                              • GetMessageA.USER32 ref: 05E2FC48
                                                                                                                                                                                                              • TranslateMessage.USER32(?), ref: 05E2FC61
                                                                                                                                                                                                              • DispatchMessageA.USER32(?), ref: 05E2FC67
                                                                                                                                                                                                              • GetMessageA.USER32 ref: 05E2FC74
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$Register$ClassCreateDeviceDispatchNotificationTranslateWindow
                                                                                                                                                                                                              • String ID: $0$gdkWindowToplevelClass
                                                                                                                                                                                                              • API String ID: 2947200908-2026830438
                                                                                                                                                                                                              • Opcode ID: 1dda01937e9f8b98ed4bbdee7a0da3fb964fee29d66a4933925f8e00deff61ad
                                                                                                                                                                                                              • Instruction ID: b7d00f886348b4552ed45a181b5307329d1d2b5694af3535e719bf90fa5a7e0f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1dda01937e9f8b98ed4bbdee7a0da3fb964fee29d66a4933925f8e00deff61ad
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D7315AB1C0434CABDB10CFE9D88A9DEBFB8AF08214F10956DE5A5A7285D7308905CF60
                                                                                                                                                                                                              Function 05E29EC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E29EDF
                                                                                                                                                                                                              • CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 05E29F16
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,00090018,00000000,00000000,00000000,00000000,?,00000000), ref: 05E29F45
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 05E29F5A
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 05E29F74
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E29F77
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ControlDeviceFile$CloseCreateHandleWritememset
                                                                                                                                                                                                              • String ID: 00100$U$\\.\PHYSICALDRIVE0
                                                                                                                                                                                                              • API String ID: 3939175881-3482488017
                                                                                                                                                                                                              • Opcode ID: 55f8a343a5cda15c99169f112e9238fb7a940d144b3edb482e2401f60bf72e53
                                                                                                                                                                                                              • Instruction ID: 70b25f98e6028a187c23139485cdcd2cb04dba7ed1179b3be845b6b31d8fafab
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 55f8a343a5cda15c99169f112e9238fb7a940d144b3edb482e2401f60bf72e53
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4C119431BD43187AF730E6A4DC0FFDA7B6C9B55B15F100284F794BA1C19AE02645C7A9
                                                                                                                                                                                                              Function 05E25820 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171nativesleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E25844
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E258B9
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 05E258CF
                                                                                                                                                                                                              • NtQueryInformationProcess.NTDLL(00000000,0000001B,00000000,00000800,00000000), ref: 05E258FC
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 05E25970
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E25A05
                                                                                                                                                                                                                • Part of subcall function 05E249F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,05E273CC,05E57C98,00000000,00000000,00000010,00000000), ref: 05E24A10
                                                                                                                                                                                                                • Part of subcall function 05E249F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 05E24A77
                                                                                                                                                                                                              • Sleep.KERNEL32(00000001), ref: 05E259F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandleInformationProcessQuery$CompareExchangeInterlockedMutexObjectReleaseSingleSleepWaitmemset
                                                                                                                                                                                                              • String ID: STFU
                                                                                                                                                                                                              • API String ID: 1902471319-778810564
                                                                                                                                                                                                              • Opcode ID: 00f7cc1605bdc6cdb63f64133bcb06ef394d1a6930d71b0e3b874cf7c00fa696
                                                                                                                                                                                                              • Instruction ID: a8e0ebe196fbebb9e9ae43aec6a7815b944e7bfa6747f89e1d063c43b80e17db
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00f7cc1605bdc6cdb63f64133bcb06ef394d1a6930d71b0e3b874cf7c00fa696
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E451B670E00329ABDB14DFA9CD45BAE77B8FB44710F149169F985EB284EB709D40CB90
                                                                                                                                                                                                              Function 05E23440 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 136memorynativeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • printf.MSVCRT ref: 05E234A0
                                                                                                                                                                                                              • printf.MSVCRT ref: 05E234AD
                                                                                                                                                                                                              • printf.MSVCRT ref: 05E234CC
                                                                                                                                                                                                              • NtAllocateVirtualMemory.NTDLL(00000000,?,00000000,05E57A80,00003000,00000040), ref: 05E234F2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: printf$AllocateMemoryVirtual
                                                                                                                                                                                                              • String ID: Done frst$block_size: %d$ngr->blocksize: %d
                                                                                                                                                                                                              • API String ID: 3635587295-1816125109
                                                                                                                                                                                                              • Opcode ID: 636e2f1cfcb1cc838263057432f46e90329b1cc6542d066983d9f287e621cecb
                                                                                                                                                                                                              • Instruction ID: 83b89d7f310027a50f60726949d70ced681c49ea52ec71929cd39487a8897253
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 636e2f1cfcb1cc838263057432f46e90329b1cc6542d066983d9f287e621cecb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D841D475B00204AFDB14DF69C849E9AB7A9FF88324F14995DE98D8B244E735EA01CF90
                                                                                                                                                                                                              Function 05E2A550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E23920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 05E23962
                                                                                                                                                                                                                • Part of subcall function 05E23750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 05E2376B
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,NtShutdownSystem), ref: 05E2A57A
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 05E2A58F
                                                                                                                                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 05E2A5B3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2A5B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: StringToken$AddressAdjustAnsiErrorLastLookupOpenPrivilegePrivilegesProcedureProcessUnicodeValue
                                                                                                                                                                                                              • String ID: NtShutdownSystem$SeShutdownPrivilege$ntdll.dll
                                                                                                                                                                                                              • API String ID: 4135695518-1699316426
                                                                                                                                                                                                              • Opcode ID: 32e27a26b961b8953efd13be70b420210d35e299c2291552ad2426b337e6c5cd
                                                                                                                                                                                                              • Instruction ID: e7903937ad6f078bbf93144d47b11a52c830e670a17358108ba091cf3f20c399
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 32e27a26b961b8953efd13be70b420210d35e299c2291552ad2426b337e6c5cd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2DF08175B84318BBE714EBE59C0FFAF7A6CAB08B05F101158B684A61C4DAB06504CBA2
                                                                                                                                                                                                              Function 05E242E0 Relevance: 10.6, APIs: 7, Instructions: 131COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 282350566c1ea7604c17f3611a0091170cfeeb6a764085f50179d77c1bd5f248
                                                                                                                                                                                                              • Instruction ID: 6116b12344aa5dd8155827db1868b5cb205d01a9a28e14c5bb993e0b3b6547ad
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 282350566c1ea7604c17f3611a0091170cfeeb6a764085f50179d77c1bd5f248
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5931F472B043146BEB209E6AEC45F6BB7ACFB84715F14555DFD8AD72C4DA31E800CAA0
                                                                                                                                                                                                              Function 05E2D7A0 Relevance: 145.7, APIs: 54, Strings: 29, Instructions: 473memorystringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000800), ref: 05E2D7C3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000800), ref: 05E2D7D2
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2D7EE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,?,00000000), ref: 05E2D80B
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2D819
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2D82F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2D83C
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2D852
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2D85B
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,00000000,00000800,00000000,00000000), ref: 05E2D87A
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 05E2D8D3
                                                                                                                                                                                                              • strchr.MSVCRT ref: 05E2D8E8
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 05E2D900
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001), ref: 05E2D924
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001), ref: 05E2D930
                                                                                                                                                                                                              • strchr.MSVCRT ref: 05E2D93F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2D952
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000001,00000000), ref: 05E2D95E
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,00000000,00000001), ref: 05E2D96D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,ftplog), ref: 05E2D97F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFree$ErrorLastlstrcpynlstrlenstrchr$FileReadatoilstrcmpmemset
                                                                                                                                                                                                              • String ID: 30e44aa1$FTP -> $POP3 -> $[DNS]: Blocked DNS "%s"$[FTP Infect]: %s was iframed$[FTP Login]: %s$[HTTP Login]: %s$[HTTP Traffic]: %s$[HTTP]: %s$[MSN]: %s$[PDef+]: %s$[POP3 Login]: %s$[Ruskill]: Detected DNS: "%s"$[Ruskill]: Detected File: "%s"$[Ruskill]: Detected Reg: "%s"$blk$block$disable$dns$ftpinfect$ftplog$httplogin$httpspread$httptraff$msn$poplog$rdns$rreg$ruskill
                                                                                                                                                                                                              • API String ID: 1531277263-3670165947
                                                                                                                                                                                                              • Opcode ID: 408a98c319801ca1aa8ee294dbee7822cbeeafb8298baffc6caba9efa336d4af
                                                                                                                                                                                                              • Instruction ID: c352f6a8d748f3421fbee0b87e0cd85c192b1da99d9678f61154344b3de13361
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 408a98c319801ca1aa8ee294dbee7822cbeeafb8298baffc6caba9efa336d4af
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 55E138B1A54328BBE710A7659D8FFBF3B2DEF85758F006018FAC5A2245DEB09801D661
                                                                                                                                                                                                              Function 05E30430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 05E30446
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000001), ref: 05E3044C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 05E30453
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E3048B
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 05E30493
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 05E304A9
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 05E304C5
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E304DC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E22780), ref: 05E304F0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E304FA
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 05E30505
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E3051B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,05E31335), ref: 05E30534
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E30557
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E22780), ref: 05E30567
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E3057B
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E30596
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 05E305A7
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 05E305F1
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E32B84), ref: 05E305F9
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E30602
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 05E3061C
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 05E30624
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E22780), ref: 05E3062B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E3062E
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E30646
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E3064F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E3065A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000040), ref: 05E30667
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E30688
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 05E306A0
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E306B7
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E306D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E306E6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 05E306F3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 05E306FF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E30714
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 05E30721
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,-00000002,?), ref: 05E3072C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E30736
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E22780), ref: 05E3073E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 05E3074B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,05E22780), ref: 05E30761
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E22780), ref: 05E3076A
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E30787
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E3079F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E307AC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E307B6
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
                                                                                                                                                                                                              • API String ID: 375969099-2909086048
                                                                                                                                                                                                              • Opcode ID: d249471239f56e4c980101e5162d461b053de9579d62f5e4bfaf1fa483d3dad8
                                                                                                                                                                                                              • Instruction ID: 1e55a80b9f79ad7bbb5c79eab7fe5a71c7fc5db711b44d626874891167f9dc24
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d249471239f56e4c980101e5162d461b053de9579d62f5e4bfaf1fa483d3dad8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54A155B5A00309BBEB14DBA5CC8FEBF7B7DEB48604F005555F985A3241EA74DA04CB60
                                                                                                                                                                                                              Function 05E2F430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431filestringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F459
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F472
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F48B
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F4A4
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F4BD
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F4D6
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F4F2
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F50B
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F526
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F541
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F55C
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2F571
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2F586
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 05E2F5A4
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2F5BC
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2F5D3
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2F5EC
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 05E2F607
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 05E2F61B
                                                                                                                                                                                                                • Part of subcall function 05E21CF0: GetFileAttributesW.KERNEL32(?), ref: 05E21CF7
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,ERR), ref: 05E2F64B
                                                                                                                                                                                                              • _stricmp.MSVCRT(05E6A920,00000000), ref: 05E2F65D
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 05E2F684
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 05E2F692
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 05E2F6A0
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 05E2F6AA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2F6B4
                                                                                                                                                                                                              • CopyFileW.KERNEL32 ref: 05E2F6CE
                                                                                                                                                                                                              • lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 05E2F6DE
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 05E2F747
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,0005E32F), ref: 05E2F7DA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,?), ref: 05E2F7EE
                                                                                                                                                                                                                • Part of subcall function 05E21EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 05E21ECD
                                                                                                                                                                                                                • Part of subcall function 05E21EA0: GetLastError.KERNEL32 ref: 05E21EDA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,05E32B84), ref: 05E2F800
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 05E2F813
                                                                                                                                                                                                              • lstrlenA.KERNEL32(0005E32F,?,00000000), ref: 05E2F828
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,0005E32F,00000000), ref: 05E2F837
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 05E2F87C
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000), ref: 05E2F88B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2F8B1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 05E2F8C4
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 05E2F901
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 05E2F93A
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 05E2F97D
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 05E2F984
                                                                                                                                                                                                              • LockFile.KERNEL32 ref: 05E2F98D
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 05E2F9BE
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 05E2F9C5
                                                                                                                                                                                                              • LockFile.KERNEL32 ref: 05E2F9CE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
                                                                                                                                                                                                              • String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
                                                                                                                                                                                                              • API String ID: 2867265384-3663527224
                                                                                                                                                                                                              • Opcode ID: 1ff019c6d7004e63b5821342b4ede06c59ea960bec7b4859b737efddfe0e32af
                                                                                                                                                                                                              • Instruction ID: 70163014152d777671d0f7e83482327ea53c49029449311e86eb8c08184563ae
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ff019c6d7004e63b5821342b4ede06c59ea960bec7b4859b737efddfe0e32af
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EAE1EA71A54228BADB24DB61CC8FFEA777CEF48744F005499F189A6044EBB45B84CFA1
                                                                                                                                                                                                              Function 05E2E9F0 Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 271stringfilethreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2EA0F
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(ws2_32.dll), ref: 05E2EA22
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(secur32.dll), ref: 05E2EA29
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(wininet.dll), ref: 05E2EA30
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,05E357AC), ref: 05E2EA3B
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 05E2EA44
                                                                                                                                                                                                                • Part of subcall function 05E27330: memset.MSVCRT ref: 05E27351
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(?), ref: 05E27369
                                                                                                                                                                                                                • Part of subcall function 05E27330: _snprintf.MSVCRT ref: 05E27381
                                                                                                                                                                                                                • Part of subcall function 05E27330: _vsnprintf.MSVCRT ref: 05E273A3
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(00000000), ref: 05E273B2
                                                                                                                                                                                                              • CopyFileW.KERNEL32 ref: 05E2EACF
                                                                                                                                                                                                                • Part of subcall function 05E2D6B0: RegSetValueExW.ADVAPI32 ref: 05E2D731
                                                                                                                                                                                                                • Part of subcall function 05E2D6B0: RegCloseKey.ADVAPI32(?), ref: 05E2D740
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 05E2EAFC
                                                                                                                                                                                                                • Part of subcall function 05E21AD0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 05E21AE9
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(05E6AFB0), ref: 05E2EB2F
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 05E2EB3A
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(05E6AFB0), ref: 05E2EB41
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6A920,ERR), ref: 05E2EB61
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E357C0), ref: 05E2EB72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E357C0), ref: 05E2EBB5
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2EBDE
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2EC15
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(05E6B3C8), ref: 05E2EC32
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2EC5F
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 05E2EC75
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(?), ref: 05E2EC95
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2EC97
                                                                                                                                                                                                                • Part of subcall function 05E21CF0: GetFileAttributesW.KERNEL32(?), ref: 05E21CF7
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E880,00000000,00000000,00000000), ref: 05E2ECB2
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2ECBB
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,05E2E990,00000000,00000000,00000000), ref: 05E2ECCC
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2ECCF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E6B3E0), ref: 05E2ED26
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E6AC50,?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000), ref: 05E2ED5E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E770,05E6B990,00000000,00000000), ref: 05E2ED83
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2ED86
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,05E2FC90,00000000,00000000,00000000), ref: 05E2EDA1
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2EDA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$File$CloseCreate$HandleThread$DeleteLibraryLoadmemset$SleepTime_snprintf$AttributesCopyCriticalErrorInitializeLastMutexObjectSectionSingleSystemValueWait_vsnprintflstrcpywsprintf
                                                                                                                                                                                                              • String ID: %s:Zone.Identifier$ERR$IPC_Check$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$msnint$msnmsg$ngrBot$running$secur32.dll$wininet.dll$ws2_32.dll
                                                                                                                                                                                                              • API String ID: 4164503275-3436408089
                                                                                                                                                                                                              • Opcode ID: 96cc906db95af81bd8c8d24debd0e2e8f76b52e206ed08fe9421e4d033fda9c8
                                                                                                                                                                                                              • Instruction ID: d855b33a361cc8d6d91ef9405df2a95fe45e6ad807e3e3ddc485cbf0eb4a4c13
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 96cc906db95af81bd8c8d24debd0e2e8f76b52e206ed08fe9421e4d033fda9c8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F81A0B5BC033876E720B7A19C4FF6A3A1D9B44BC8F043015FAC9B5185DDF0A504DAA6
                                                                                                                                                                                                              Function 05E2E130 Relevance: 59.8, APIs: 24, Strings: 10, Instructions: 255sleepstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(05E6B3C8), ref: 05E2E14B
                                                                                                                                                                                                                • Part of subcall function 05E29FF0: strtok.MSVCRT ref: 05E2A013
                                                                                                                                                                                                                • Part of subcall function 05E29FF0: strtok.MSVCRT ref: 05E2A04F
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2E17E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2E18B
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2E198
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2E1A5
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 05E2E1C8
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 05E2E22B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2E24D
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E2E259
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(00000000,05E6ADA0,0000000B), ref: 05E2E292
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(00000000,05E6ADA0,00000004), ref: 05E2E2A4
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6A920,00000000), ref: 05E2E2C0
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,05E32C7C), ref: 05E2E2D3
                                                                                                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 05E2E2FA
                                                                                                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 05E2E30A
                                                                                                                                                                                                                • Part of subcall function 05E2BA00: memset.MSVCRT ref: 05E2BA1E
                                                                                                                                                                                                                • Part of subcall function 05E2BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 05E2BA42
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(00000000), ref: 05E2E43A
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2E45D
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 05E2E46B
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6B3C8), ref: 05E2E478
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [d="%s"] Error getting temporary filename. [e="%d"], xrefs: 05E2E3D1
                                                                                                                                                                                                              • [d="%s"] Error writing download to "%S" [e="%d"], xrefs: 05E2E383, 05E2E3AE
                                                                                                                                                                                                              • [d='%s"] Error getting application data path [e="%d"], xrefs: 05E2E3F4
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d, xrefs: 05E2E41C
                                                                                                                                                                                                              • QUIT :%s, xrefs: 05E2E2E3
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s), xrefs: 05E2E359
                                                                                                                                                                                                              • bsod, xrefs: 05E2E312
                                                                                                                                                                                                              • [d="%s"] Error downloading file [e="%d"], xrefs: 05E2E405
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 05E2E36E
                                                                                                                                                                                                              • rebooting, xrefs: 05E2E2DE
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLastSleep$File$CriticalMoveSectionstrtok$??3@DeleteEnterFreeHeapLeave_memicmplstrcmplstrcpylstrlenmemsetwvsprintf
                                                                                                                                                                                                              • String ID: QUIT :%s$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$bsod$rebooting
                                                                                                                                                                                                              • API String ID: 4206007775-4213298338
                                                                                                                                                                                                              • Opcode ID: 6f4b93fc7a3551d5ad202545e330e8a9fbd09ec254f0328321c7a907626a79e4
                                                                                                                                                                                                              • Instruction ID: 9d1842ebda436f541fc821328c31853fc496a65e1b6e08cf9fc543f38864e115
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f4b93fc7a3551d5ad202545e330e8a9fbd09ec254f0328321c7a907626a79e4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4881F6B0A44328FBE7109BA5DC4FEBE777DAF44749F006519F9C2D2145EAB09900DA22
                                                                                                                                                                                                              Function 05E2DDB0 Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 281sleepstringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(05E6B3C8), ref: 05E2DDCF
                                                                                                                                                                                                                • Part of subcall function 05E29FF0: strtok.MSVCRT ref: 05E2A013
                                                                                                                                                                                                                • Part of subcall function 05E29FF0: strtok.MSVCRT ref: 05E2A04F
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2DDF4
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2DE11
                                                                                                                                                                                                              • toupper.MSVCRT ref: 05E2DE28
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2DE68
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2DE71
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2DE7A
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2DE83
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 05E2DEA8
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 05E2DF16
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,00000000), ref: 05E2DF3D
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 05E2DF6A
                                                                                                                                                                                                              • GetLastError.KERNEL32([d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"],?,?,?,00000000), ref: 05E2E021
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2E059
                                                                                                                                                                                                              • GetLastError.KERNEL32([d="%s" s="%d bytes"] Error creating process "%S" [e="%d"],?,?,?,00000000), ref: 05E2E037
                                                                                                                                                                                                                • Part of subcall function 05E2BA00: memset.MSVCRT ref: 05E2BA1E
                                                                                                                                                                                                                • Part of subcall function 05E2BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 05E2BA42
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2E0DD
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 05E2E0EB
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6B3C8), ref: 05E2E0F8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d, xrefs: 05E2E0A5
                                                                                                                                                                                                              • exe, xrefs: 05E2DEE4
                                                                                                                                                                                                              • http://, xrefs: 05E2DDEE
                                                                                                                                                                                                              • ERR, xrefs: 05E2DFEC
                                                                                                                                                                                                              • [d="%s"] Error getting temporary filename. [e="%d"], xrefs: 05E2E060
                                                                                                                                                                                                              • [d="%s"] Error writing download to "%S" [e="%d"], xrefs: 05E2E042
                                                                                                                                                                                                              • [d='%s"] Error getting application data path [e="%d"], xrefs: 05E2E080
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Error creating process "%S" [e="%d"], xrefs: 05E2E030
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s), xrefs: 05E2DFFE
                                                                                                                                                                                                              • dlds, xrefs: 05E2DE44, 05E2DFA6
                                                                                                                                                                                                              • [d="%s"] Error downloading file [e="%d"], xrefs: 05E2E08E
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 05E2E017
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$Sleep$CriticalSectionstrtok$??3@EnterFreeHeapLeave_stricmplstrlenmemsetstrstrtoupperwvsprintf
                                                                                                                                                                                                              • String ID: ERR$[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]$[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$dlds$exe$http://
                                                                                                                                                                                                              • API String ID: 3190375853-4059846736
                                                                                                                                                                                                              • Opcode ID: e927993de23c9d61a8e6d5f4eecd57d629b600cdb34825c147a8a32aec6c5318
                                                                                                                                                                                                              • Instruction ID: e7d298f6b2e65d254b129c92600e137e0eff3167ec2ab02e5f67be091ea0e2a1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e927993de23c9d61a8e6d5f4eecd57d629b600cdb34825c147a8a32aec6c5318
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F91DAB5E04324AFE714DB95CD4AEBFB7BDAF54744F106018E6C693248E670E902C761
                                                                                                                                                                                                              Function 05E27870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E27898
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 05E2795D
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2797B
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E279B7
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E6A2B0,?,00000000,?), ref: 05E27A5A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E6A4B0), ref: 05E27A69
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E27AD9
                                                                                                                                                                                                              • _stricmp.MSVCRT(05E6A2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,05E6A2B0,05E6A4B0,00000000,00000000), ref: 05E27AE8
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E27B66
                                                                                                                                                                                                                • Part of subcall function 05E22460: GetProcessHeap.KERNEL32(?,05E220DE,?), ref: 05E2246C
                                                                                                                                                                                                                • Part of subcall function 05E22460: HeapAlloc.KERNEL32(?,00000008,05E220DE,?,05E220DE,?), ref: 05E2247E
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6A2B0,05E31335,?,00000000,?), ref: 05E27BBC
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6A4B0,05E31335), ref: 05E27BC8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
                                                                                                                                                                                                              • String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
                                                                                                                                                                                                              • API String ID: 389836911-2374598668
                                                                                                                                                                                                              • Opcode ID: 87abdb0286e9bf8ba5a6dbc7e733b28efa4d4f6b6be2d98dcd5ed1d90205202d
                                                                                                                                                                                                              • Instruction ID: 159961f57fb46ed596c1e79da2042576781d6d522dafaf13c858899684bb24ef
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 87abdb0286e9bf8ba5a6dbc7e733b28efa4d4f6b6be2d98dcd5ed1d90205202d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E0813870F84375AAEB20AE298D4EF7F3B56EB0179DF057068E8C5B2109EAB0D540C752
                                                                                                                                                                                                              Function 05E30910 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 172sleepstringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E30930
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 05E3093D
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E3095D
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 05E30982
                                                                                                                                                                                                              • ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000,00000005), ref: 05E309BF
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27401
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27419
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E27431
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _snprintf.MSVCRT ref: 05E27449
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _vsnprintf.MSVCRT ref: 05E2746B
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E2747A
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E309CF
                                                                                                                                                                                                              • Sleep.KERNEL32 ref: 05E30A05
                                                                                                                                                                                                              • OpenMutexA.KERNEL32 ref: 05E30A17
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E30A27
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E30A2E
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 05E30A32
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 05E30A3D
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E30A60
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 05E30A79
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 05E30A98
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,05E6AFB0,00000208), ref: 05E30ACC
                                                                                                                                                                                                              • wsprintfW.USER32 ref: 05E30ADE
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,05E6ADA0,000000FF,05E6AC50,00000104,00000000,00000000), ref: 05E30B06
                                                                                                                                                                                                              • lstrcpynW.KERNEL32(05E6B1B8,00000000,00000208), ref: 05E30B13
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,05E6B3E0,00000104,00000000,00000000), ref: 05E30B2E
                                                                                                                                                                                                              • Sleep.KERNEL32(000009C4), ref: 05E30B59
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 05E30B70
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$Exitmemset$lstrlen$ByteCharErrorFileLastModuleMultiNameSleepWide_snprintf$CountExecuteHeapMutexOpenShellTick_vsnprintflstrcpynwsprintf
                                                                                                                                                                                                              • String ID: %08x$%s\Microsoft\%s.exe$30e44aa1$OPEN$ngrBot$running
                                                                                                                                                                                                              • API String ID: 2173303953-2917108782
                                                                                                                                                                                                              • Opcode ID: f7aa975702fb672346dac93b68ba95af1217079af3539463d9f8960d26dd668b
                                                                                                                                                                                                              • Instruction ID: 02668e0ee6840caa6bb4d4c49437284ebc0c5ee9dbe4a6ebfd3fa17b8b85fdb3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f7aa975702fb672346dac93b68ba95af1217079af3539463d9f8960d26dd668b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B351E375B88318BBE714ABA29C4FFDA3E689B44B45F006454F6C9E61C1EEF05144CB62
                                                                                                                                                                                                              Function 05E2FE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000,05E3037C,?,05E332E4,00000000,00000000,httpi), ref: 05E2FE11
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FE40
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 05E2FE47
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FE5E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FE72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FE7C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000002), ref: 05E2FE89
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2FEA2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,05E31335), ref: 05E2FEBB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E319DC), ref: 05E2FECD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2FEE4
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E2FEEF
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 05E2FF0A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FF14
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 05E2FF1F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FF33
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E33328), ref: 05E2FF4B
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2FF5C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2FF65
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FF6B
                                                                                                                                                                                                              • strncat.MSVCRT ref: 05E2FF77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E32B54), ref: 05E2FF85
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FF8F
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 05E2FF9A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2FFAA
                                                                                                                                                                                                                • Part of subcall function 05E2FD80: isalnum.MSVCRT ref: 05E2FDAC
                                                                                                                                                                                                                • Part of subcall function 05E2FD80: strchr.MSVCRT ref: 05E2FDBE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 05E2FFBE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2FFCB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 05E2FFDF
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2FFEC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E3000F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E3001C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E3003C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 423345748-0
                                                                                                                                                                                                              • Opcode ID: de83816144a39324cccc413e5a5b2feaffe15a556cc932eb4ceed5b914db2a11
                                                                                                                                                                                                              • Instruction ID: 86d2a18c10d534e59ae674ade2045e51bf769e89249fdb6586c9a3e30f7d1b6f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: de83816144a39324cccc413e5a5b2feaffe15a556cc932eb4ceed5b914db2a11
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF61A075A04218BBEB159FA5CC8EEBF7B79FB84604F104248F948D7244EB74D941CBA0
                                                                                                                                                                                                              Function 05E299B0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 205networkstringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E299D5
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E299EF
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000002,?), ref: 05E29A00
                                                                                                                                                                                                                • Part of subcall function 05E29300: inet_addr.WS2_32(05E2226E), ref: 05E29308
                                                                                                                                                                                                                • Part of subcall function 05E29300: gethostbyname.WS2_32(05E2226E), ref: 05E29313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 05E29A28
                                                                                                                                                                                                              • GetTickCount.KERNEL32(00000050,?), ref: 05E29A3A
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E29A4D
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000000), ref: 05E29A7B
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 05E29A96
                                                                                                                                                                                                              • connect.WS2_32(?,?,00000010), ref: 05E29AB1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 05E29ABE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E29AC4
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,X-a: b), ref: 05E29AFE
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Connection: Close), ref: 05E29B0C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E29B0F
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 05E29B41
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000), ref: 05E29B51
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E29B5E
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E29B66
                                                                                                                                                                                                              • Sleep.KERNEL32(000009C4), ref: 05E29B7F
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 05E29BBE
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?,00000000,00000000,00000000), ref: 05E29BD2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E29BE4
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 05E29C1E
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 05E29C38
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?,?,00000000,00000000,00000000), ref: 05E29C43
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleeplstrlensend$lstrcpymemset$Startupclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
                                                                                                                                                                                                              • String ID: Connection: Close$X-a: b
                                                                                                                                                                                                              • API String ID: 1989272289-3524857483
                                                                                                                                                                                                              • Opcode ID: bd53dc0f856c714f369b4485a5d0661bdbfc5f336a252bca79aaaef69789fedf
                                                                                                                                                                                                              • Instruction ID: 13900b8784feee4953d9d929777a3ad4d653100339b0f4889f3e3323e705346f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd53dc0f856c714f369b4485a5d0661bdbfc5f336a252bca79aaaef69789fedf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1871FD72A04228BBDB20EBA1DC4EFDE7779AF48704F006555E98AE7144DA709E81CB94
                                                                                                                                                                                                              Function 05E2AFA0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 149stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Alloc_memicmp_snprintfmemsetstrtok$Freelstrcpynsscanf
                                                                                                                                                                                                              • String ID: HTTP$Host: $POST /%1023s$http://%s/$http://%s/%s
                                                                                                                                                                                                              • API String ID: 3179755921-1264106924
                                                                                                                                                                                                              • Opcode ID: d55d8fc4b2fd75d340c235e3b7b9f26820cd69e63e67bab96d702f15413e118b
                                                                                                                                                                                                              • Instruction ID: 81ece071c30e645a75db87f5324be04bc377637099b3c3cfccbddabacd9a9b60
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d55d8fc4b2fd75d340c235e3b7b9f26820cd69e63e67bab96d702f15413e118b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7241F7B6E4032867DB20EB659C4EFEB77ADEF44654F045094FBC8A2140EA705A09CBA1
                                                                                                                                                                                                              Function 05E26A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E26A68
                                                                                                                                                                                                              • lstrlenA.KERNEL32 ref: 05E26B03
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E26B0E
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E26B22
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E26B36
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 05E26B4F
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 05E26B69
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E26BD5
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(05E6A710,00000080), ref: 05E26C31
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(05E6A710,00000000,00000004), ref: 05E26C40
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 05E26C60
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 05E26C67
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A335
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A34F
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A369
                                                                                                                                                                                                                • Part of subcall function 05E2A310: _vsnprintf.MSVCRT ref: 05E2A382
                                                                                                                                                                                                                • Part of subcall function 05E2A310: sprintf.MSVCRT ref: 05E2A39A
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB,%s.%s,blk,?,?,000001FE,05E30A8E), ref: 05E2A3AD
                                                                                                                                                                                                                • Part of subcall function 05E2A310: _snprintf.MSVCRT ref: 05E2A3CC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB), ref: 05E2A3DB
                                                                                                                                                                                                                • Part of subcall function 05E2A310: sprintf.MSVCRT ref: 05E2A3EC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A3FB
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A404
                                                                                                                                                                                                                • Part of subcall function 05E2A310: EnterCriticalSection.KERNEL32(05E6AC34,?,?,00000000), ref: 05E2A436
                                                                                                                                                                                                                • Part of subcall function 05E2A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 05E2A452
                                                                                                                                                                                                                • Part of subcall function 05E2A310: LeaveCriticalSection.KERNEL32(05E6AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05E2A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
                                                                                                                                                                                                              • String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
                                                                                                                                                                                                              • API String ID: 1085873876-1467418891
                                                                                                                                                                                                              • Opcode ID: d1e9434d87073b68bb3e46fe538e1cb1a20d8062e1698ceacfe2f8e57104f1c6
                                                                                                                                                                                                              • Instruction ID: 573ad58d1d1c8433296be7ac355d4bfcb9952a772177a9e10f7fcf5d1b1ed265
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d1e9434d87073b68bb3e46fe538e1cb1a20d8062e1698ceacfe2f8e57104f1c6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F510872E40218BBEF20EB558C8FFAE3779FB44748F042568F9C4A2144EEB0A944D661
                                                                                                                                                                                                              Function 05E30050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E30071
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 05E30080
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E300AB
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 05E300B6
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 05E300CB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E300D2
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 05E300E3
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E300F9
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E30117
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E30129
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E32B84), ref: 05E30141
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E3014E
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 05E30160
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E30177
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 05E3018A
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E30193
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 05E301AB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 05E301B2
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 05E301BE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
                                                                                                                                                                                                              • String ID: $Content-Length:
                                                                                                                                                                                                              • API String ID: 4006885983-3599722475
                                                                                                                                                                                                              • Opcode ID: 211490fdfaa96d4b3a01857cf62d09ea7e074da90c2439a18702c691e3cc2d01
                                                                                                                                                                                                              • Instruction ID: 8e75afce726a8f63b0fdee6bf75e788be9a899d8c121e0ecb9fa5202b87574e0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 211490fdfaa96d4b3a01857cf62d09ea7e074da90c2439a18702c691e3cc2d01
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3941E3357043187BEB20AB65DC4FFBE77ACAF44719F005159FDC8A6200EAB49A45CAA1
                                                                                                                                                                                                              Function 05E2A310 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 127stringfilesleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2A335
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2A34F
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2A369
                                                                                                                                                                                                              • _vsnprintf.MSVCRT ref: 05E2A382
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2A39A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB,%s.%s,blk,?,?,000001FE,05E30A8E), ref: 05E2A3AD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2A3CC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB), ref: 05E2A3DB
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2A3EC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A3FB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A404
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(05E6AC34,?,?,00000000), ref: 05E2A436
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 05E2A452
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05E2A464
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 05E2A484
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2A48B
                                                                                                                                                                                                              • Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05E2A496
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05E2A4A1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CriticalSectionmemset$FileLeavesprintf$CloseCreateEnterHandleSleepWrite_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %d.$30e44aa1$\\.\pipe\%08x_ipc
                                                                                                                                                                                                              • API String ID: 4010528547-3602371622
                                                                                                                                                                                                              • Opcode ID: da3e2f9b0c7d6415581f1f16eaeac545d7eeac438848d556a82e9f35903aa7c4
                                                                                                                                                                                                              • Instruction ID: 65c5c1341fcf41dd960d90bdce3b582b62477b31e8c3aedc1c8134ba5a5e8952
                                                                                                                                                                                                              • Opcode Fuzzy Hash: da3e2f9b0c7d6415581f1f16eaeac545d7eeac438848d556a82e9f35903aa7c4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8841E6B6B8031CBBD714E7A1DC4EFEA372CDB88701F004494F788A6180DAB06A44CBA5
                                                                                                                                                                                                              Function 05E301E0 Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 189memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E30202
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 05E30213
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(05E6B4E4), ref: 05E30223
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E30243
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E30254
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 05E3025F
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 05E30272
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E30281
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E302C8
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E302EF
                                                                                                                                                                                                              • atoi.MSVCRT(00000000,?,http,int), ref: 05E30322
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E30386
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E303E4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E303EE
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6B4E4), ref: 05E303FD
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 05E3041F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Freestrstr$CriticalSectionlstrlen$AllocEnterLeaveProcess_snprintfatoilstrcpymemset
                                                                                                                                                                                                              • String ID: $%s.%s hijacked!$%s=$http$httpi$httpspread$int$msg
                                                                                                                                                                                                              • API String ID: 2097228407-1593535274
                                                                                                                                                                                                              • Opcode ID: f1a097a55c1f644749e1d7e7c0e8090f4e2b4888e5369f646ba533a972f92c6c
                                                                                                                                                                                                              • Instruction ID: 5e05d94b1c1e50ba45157cf812b2e28f7154329464539d032cacebd408d02835
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f1a097a55c1f644749e1d7e7c0e8090f4e2b4888e5369f646ba533a972f92c6c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6651A771B44319BBEB10DBA19C8FBBEB779FF44744F045069F9D5A6200EA74A900CBA0
                                                                                                                                                                                                              Function 05E2AE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,05E27CC2,00000000,05E32914,?,?,?,?,?,?), ref: 05E2AE11
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001,?,05E27CC2,00000000,05E32914,?,?,?,?,?,?,?,00000000), ref: 05E2AE23
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 05E2AE41
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2AE59
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 05E2AE70
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 05E2AE77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E32B54), ref: 05E2AE7F
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2AE8E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2AEA1
                                                                                                                                                                                                              • _strnicmp.MSVCRT ref: 05E2AEA6
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2AEB9
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2AED5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2AEEB
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2AF10
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 05E2AF20
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 05E2AF27
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 05E2AF2B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 05E2AF3D
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000001), ref: 05E2AF58
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 05E2AF5F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 05E2AF6B
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2AF82
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2AF91
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3119447416-0
                                                                                                                                                                                                              • Opcode ID: babdb61ed9cf827f27c63d552d80a5aade8242c9394c9051ff146f62491db11a
                                                                                                                                                                                                              • Instruction ID: 3b254d4b5c179ef80ea43ba3a0bdfed7e3568d2195235958bb4a5b309d5398cb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: babdb61ed9cf827f27c63d552d80a5aade8242c9394c9051ff146f62491db11a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5941A0B6A04324ABD7109F65DC8AFAB37BDFF49645F144068F984A7240DA74F902CBB1
                                                                                                                                                                                                              Function 05E2D220 Relevance: 33.2, APIs: 11, Strings: 11, Instructions: 209stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstrstrtok$lstrcmplstrlen
                                                                                                                                                                                                              • String ID: 001$332$376$433$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
                                                                                                                                                                                                              • API String ID: 4048585210-3109762459
                                                                                                                                                                                                              • Opcode ID: 163256c384e479f8947250473709602ac529a44980a78da255ee5a29551c6d92
                                                                                                                                                                                                              • Instruction ID: ad0730555b59f71149ca5e7d3b3b410bfd7bef297afa5612a1c7fef94dd325f1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 163256c384e479f8947250473709602ac529a44980a78da255ee5a29551c6d92
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5513BB7B4422927E710B629FC8AE7A736CEB84159F007166FDC8D6204F931E9018AE1
                                                                                                                                                                                                              Function 05E225D0 Relevance: 31.7, APIs: 7, Strings: 14, Instructions: 191stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • sscanf.MSVCRT ref: 05E2260F
                                                                                                                                                                                                                • Part of subcall function 05E307D0: lstrlenA.KERNEL32(05E2262A,?,?,00000000,?,05E2262A,?,05E37008), ref: 05E307DC
                                                                                                                                                                                                                • Part of subcall function 05E307D0: lstrcpyA.KERNEL32(00000000,05E2262A,?,05E37008), ref: 05E307F9
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2264F
                                                                                                                                                                                                                • Part of subcall function 05E27700: memset.MSVCRT ref: 05E2771E
                                                                                                                                                                                                                • Part of subcall function 05E27700: _snprintf.MSVCRT ref: 05E27738
                                                                                                                                                                                                                • Part of subcall function 05E27700: lstrlenA.KERNEL32(00000000), ref: 05E27747
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 05E226FB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 05E22713
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2276B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,00000000), ref: 05E2278C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E227F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$atoi$FreeHeap_snprintflstrcpymemsetsscanfstrstr
                                                                                                                                                                                                              • String ID: %s.p10-> Message hijacked!$%s.p10-> Message to %s hijacked!$%s.p21-> Message hijacked!$CAL $CAL %d %256s$MSG $MSG $SDG $X-MMS-IM-Format:$baddr$msn$msnint$msnmsg$msnu
                                                                                                                                                                                                              • API String ID: 1527159713-2027340701
                                                                                                                                                                                                              • Opcode ID: ec161b85148d72302f8aedcd4b2b45e1b256f020c828c1482d48cd1fb66e764f
                                                                                                                                                                                                              • Instruction ID: de0c006b67d051015e63cf778b45cd5a485af4749a6f17164e1ab6506c469111
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec161b85148d72302f8aedcd4b2b45e1b256f020c828c1482d48cd1fb66e764f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1651AF7BF0832477DB30AF559C8FDBE7765EB40619F00A0ADF9C5A2104ED719500C692
                                                                                                                                                                                                              Function 05E27C00 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 175stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E27C62
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 05E27D58
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,WHM), ref: 05E27D71
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,WHCMS), ref: 05E27D8A
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,Directadmin), ref: 05E27DA3
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A335
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A34F
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A369
                                                                                                                                                                                                                • Part of subcall function 05E2A310: _vsnprintf.MSVCRT ref: 05E2A382
                                                                                                                                                                                                                • Part of subcall function 05E2A310: sprintf.MSVCRT ref: 05E2A39A
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB,%s.%s,blk,?,?,000001FE,05E30A8E), ref: 05E2A3AD
                                                                                                                                                                                                                • Part of subcall function 05E2A310: _snprintf.MSVCRT ref: 05E2A3CC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB), ref: 05E2A3DB
                                                                                                                                                                                                                • Part of subcall function 05E2A310: sprintf.MSVCRT ref: 05E2A3EC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A3FB
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A404
                                                                                                                                                                                                                • Part of subcall function 05E2A310: EnterCriticalSection.KERNEL32(05E6AC34,?,?,00000000), ref: 05E2A436
                                                                                                                                                                                                                • Part of subcall function 05E2A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 05E2A452
                                                                                                                                                                                                                • Part of subcall function 05E2A310: LeaveCriticalSection.KERNEL32(05E6AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05E2A464
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 05E27E02
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 05E27E12
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27401
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27419
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E27431
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _snprintf.MSVCRT ref: 05E27449
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _vsnprintf.MSVCRT ref: 05E2746B
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E2747A
                                                                                                                                                                                                                • Part of subcall function 05E27330: memset.MSVCRT ref: 05E27351
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(?), ref: 05E27369
                                                                                                                                                                                                                • Part of subcall function 05E27330: _snprintf.MSVCRT ref: 05E27381
                                                                                                                                                                                                                • Part of subcall function 05E27330: _vsnprintf.MSVCRT ref: 05E273A3
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(00000000), ref: 05E273B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
                                                                                                                                                                                                              • String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
                                                                                                                                                                                                              • API String ID: 3716863481-3153587688
                                                                                                                                                                                                              • Opcode ID: 090c0d750981cd790e604d918c1a2ec0053050ad2c734b6bf538368ec431e61d
                                                                                                                                                                                                              • Instruction ID: b48200b38fd13855bcc4d8f5c16c168119f9068e8ed555b7422707d6cb14b1e3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 090c0d750981cd790e604d918c1a2ec0053050ad2c734b6bf538368ec431e61d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24518FB5F04229BBEF14DBA59C4ADBB736DFB45609B04605CE8C6A3204EA70ED01D7B1
                                                                                                                                                                                                              Function 05E2EFE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 106stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmp$AttributesFile_snprintfmemsetstrrchr$ExtensionFindPath
                                                                                                                                                                                                              • String ID: %windir%\system32\cmd.exe$&&%%windir%%\explorer.exe %%cd%%%s$.lnk$/c "start %%cd%%RECYCLED\%s$RECYCLED
                                                                                                                                                                                                              • API String ID: 1691573101-2902080580
                                                                                                                                                                                                              • Opcode ID: d18c185787ea5d93ce98c7d405d036de549686e8f872dcb84cf6ed26df74eb1a
                                                                                                                                                                                                              • Instruction ID: 123d871aea4b8f0ce11c12fb294a49086b428a570edda9095feeb3d9d37c28f6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d18c185787ea5d93ce98c7d405d036de549686e8f872dcb84cf6ed26df74eb1a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B231EA7274832966E720A65ADC0FFEB336CEF44B45F081064FAC9A1085DFB49A45CEB1
                                                                                                                                                                                                              Function 05E2E590 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 141stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2E5B0
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(05E6B3C8), ref: 05E2E5C9
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2E5FE
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2E617
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2E62D
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2E642
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2E655
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E2E65B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,05E31335), ref: 05E2E678
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 05E2E687
                                                                                                                                                                                                                • Part of subcall function 05E27500: lstrlenA.KERNEL32(?), ref: 05E2752B
                                                                                                                                                                                                                • Part of subcall function 05E27500: _snprintf.MSVCRT ref: 05E27547
                                                                                                                                                                                                                • Part of subcall function 05E27500: _vsnprintf.MSVCRT ref: 05E27569
                                                                                                                                                                                                                • Part of subcall function 05E27500: lstrcmpA.KERNEL32(?,bdns), ref: 05E2758B
                                                                                                                                                                                                                • Part of subcall function 05E27500: StrStrIA.SHLWAPI(?,00000000), ref: 05E2759F
                                                                                                                                                                                                                • Part of subcall function 05E27500: lstrlenA.KERNEL32(?), ref: 05E275B9
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2E6CF
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2E71E
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 05E2E72D
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6B3C8), ref: 05E2E73A
                                                                                                                                                                                                                • Part of subcall function 05E2AA10: memset.MSVCRT ref: 05E2AA31
                                                                                                                                                                                                                • Part of subcall function 05E2AA10: lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 05E2AA45
                                                                                                                                                                                                                • Part of subcall function 05E2AA10: InternetOpenA.WININET(00000000,?,?,?,?), ref: 05E2AA60
                                                                                                                                                                                                                • Part of subcall function 05E2AA10: lstrlenA.KERNEL32(?), ref: 05E2AA78
                                                                                                                                                                                                                • Part of subcall function 05E2AA10: InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 05E2AA8C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$strstr$CriticalInternetOpenSectionlstrcpymemsetstrtok$??3@EnterFreeHeapLeave_snprintf_vsnprintflstrcmplstrcpyn
                                                                                                                                                                                                              • String ID: [DNS]: Blocked %d domain(s) - Redirected %d domain(s)$bdns$block
                                                                                                                                                                                                              • API String ID: 1940452476-536441337
                                                                                                                                                                                                              • Opcode ID: bf28d67dae14418fa810baff56d07503299a2fb06bd0a13c92072cd3ab3dc7ea
                                                                                                                                                                                                              • Instruction ID: b452017f890854c550114e53cb50db3671972fcc80e174a709df069d0ca05f1f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bf28d67dae14418fa810baff56d07503299a2fb06bd0a13c92072cd3ab3dc7ea
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 884128B6E443287BDB14A7A59C8FCFE7B7CEF84704F046059F9C5A3204EAB05A40C6A1
                                                                                                                                                                                                              Function 05E2B300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 129stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000208), ref: 05E2B312
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 05E2B319
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2B339
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2B354
                                                                                                                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000208), ref: 05E2B387
                                                                                                                                                                                                              • lstrcpynW.KERNEL32(?,?,00000004), ref: 05E2B3A1
                                                                                                                                                                                                              • GetVolumeInformationW.KERNEL32 ref: 05E2B3BB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 05E2B3D8
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 05E2B3F0
                                                                                                                                                                                                              • lstrcatW.KERNEL32(00000000,.exe), ref: 05E2B461
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlenmemset$AllocDirectoryInformationProcessVolumeWindowslstrcatlstrcpyn
                                                                                                                                                                                                              • String ID: .exe$30e44aa1$lol$lol.exe
                                                                                                                                                                                                              • API String ID: 1748614950-52295467
                                                                                                                                                                                                              • Opcode ID: 99e1a304dc9a8ea5573944cd36f35bcfac4da1e18879baea5995b6e208ceb405
                                                                                                                                                                                                              • Instruction ID: 4d3a92386a132484b5aaeba0a70d92bedcecdf3262d62b01ef3d8f026e4f0288
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99e1a304dc9a8ea5573944cd36f35bcfac4da1e18879baea5995b6e208ceb405
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91414F71605328A6D720CB66CC4EAEFBF7DEF84311F00D19AF598D6141E6B48A00D7A5
                                                                                                                                                                                                              Function 05E2AA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2AA31
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 05E2AA45
                                                                                                                                                                                                              • InternetOpenA.WININET(00000000,?,?,?,?), ref: 05E2AA60
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2AA78
                                                                                                                                                                                                              • InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 05E2AA8C
                                                                                                                                                                                                              • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 05E2AAC0
                                                                                                                                                                                                              • InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 05E2AAE2
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 05E2AB15
                                                                                                                                                                                                              • InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 05E2AB67
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 05E2AB85
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 05E2ABA5
                                                                                                                                                                                                              • InternetCloseHandle.WININET(00000000), ref: 05E2ABE7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
                                                                                                                                                                                                              • String ID: Mozilla/4.0
                                                                                                                                                                                                              • API String ID: 2392773942-2634101963
                                                                                                                                                                                                              • Opcode ID: 35fadffe5876ed7241c30fbc1c10c282dfeb0a6e7e9b9f51fac9b5c4d3a80975
                                                                                                                                                                                                              • Instruction ID: 0f7066ea59c82cb13383473640155cf48c3a65bfba48440e224c770e88262644
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35fadffe5876ed7241c30fbc1c10c282dfeb0a6e7e9b9f51fac9b5c4d3a80975
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BF515F71A14219ABD760CF56D88ABAB7BEDFF44388F0440ADF989D7241DB709944CF50
                                                                                                                                                                                                              Function 05E2EE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CoCreateInstance.OLE32(05E33634,00000000,00000001,05E33614,?), ref: 05E2EE5B
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2EE81
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 05E2EE9A
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E32C78), ref: 05E2EEAE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 05E2EEBB
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2EED5
                                                                                                                                                                                                              • SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 05E2EEF4
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2EF68
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 05E2EF7B
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,.lnk), ref: 05E2EF89
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 05E2EFA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
                                                                                                                                                                                                              • String ID: .lnk$shell32.dll
                                                                                                                                                                                                              • API String ID: 3196525290-3399515747
                                                                                                                                                                                                              • Opcode ID: 0bfa239e6fee84d97c14b11e77d1c352fe0dba107b6ca31411bddd551426121a
                                                                                                                                                                                                              • Instruction ID: 4a009a103fba7b2cdff6d439a38d5e4b266dad573289576662047437c79f20c5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0bfa239e6fee84d97c14b11e77d1c352fe0dba107b6ca31411bddd551426121a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 60515475A04218AFDB54DB94CC86FDAB7B8AF8C704F104588F648E7290DBB0AE45CB64
                                                                                                                                                                                                              Function 05E22220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E22243
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 05E22257
                                                                                                                                                                                                                • Part of subcall function 05E29300: inet_addr.WS2_32(05E2226E), ref: 05E29308
                                                                                                                                                                                                                • Part of subcall function 05E29300: gethostbyname.WS2_32(05E2226E), ref: 05E29313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 05E22288
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 05E22297
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 05E222AE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E222C3
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E222F4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E22307
                                                                                                                                                                                                              • send.WS2_32(00000000,00000000,00000400,00000000), ref: 05E22344
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E22350
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 05E22363
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
                                                                                                                                                                                                              • String ID: gfff$i.root-servers.org
                                                                                                                                                                                                              • API String ID: 99835129-3534201491
                                                                                                                                                                                                              • Opcode ID: b3deffa46a5ba09c0030870f8e7cc6aa7a66ba60a08b186a26cd022be29d7786
                                                                                                                                                                                                              • Instruction ID: b9165b4e1cc2564908622a663fe3d0a8ad3fab245a1b78e1c51bdddfc6a81e07
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3deffa46a5ba09c0030870f8e7cc6aa7a66ba60a08b186a26cd022be29d7786
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0731AC72B002285BDB14D26D9C4EBFEB2699F84710F044565EE8CE72C4EAB08D4587D2
                                                                                                                                                                                                              Function 05E296B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E296D0
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E296EE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2970B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 05E29728
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E29735
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E29751
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2981C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [SYN]: Starting flood on "%s:%d" for %d second(s), xrefs: 05E297BA
                                                                                                                                                                                                              • [SYN]: Finished flood on "%s:%d", xrefs: 05E297F0
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [SYN]: Finished flood on "%s:%d"$[SYN]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-3475151101
                                                                                                                                                                                                              • Opcode ID: 7566b2534b050172d95e9556edf190965f5d91f9d2fa61e5f40860d0f95214d4
                                                                                                                                                                                                              • Instruction ID: 5e2493f46788aeed3256633232afe55c36b1fd4031a8262f0c7f68cc1991d65d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7566b2534b050172d95e9556edf190965f5d91f9d2fa61e5f40860d0f95214d4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 683107F3A1431C6BE720A6A1AC4FF77375CEB44749F046069FAC5E2145EA715904CBA1
                                                                                                                                                                                                              Function 05E29830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E29850
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E2986E
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2988B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 05E298A8
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E298B5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E298D1
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2999C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 05E2993A
                                                                                                                                                                                                              • [UDP]: Finished flood on "%s:%d", xrefs: 05E29970
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-2644890838
                                                                                                                                                                                                              • Opcode ID: 2416680fee434a91228d9467fb3cd0833d065f4c5e745a8dc7664a0e97708df9
                                                                                                                                                                                                              • Instruction ID: c1bc0aad4e87e308d61b7fcd34f6fa4ead62f43c006363f0adf1e1ead0f40985
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2416680fee434a91228d9467fb3cd0833d065f4c5e745a8dc7664a0e97708df9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DA312AF2B1431C6BE720A6A2AC4FF77376CEB4435DF046069FAC5E2145D9716904CB61
                                                                                                                                                                                                              Function 05E212B5 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 108COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Filewcsstr$Attributes$Move
                                                                                                                                                                                                              • String ID: %s.%S$DBWIN$\\.\pipe$brk$dll$exe$ruskill
                                                                                                                                                                                                              • API String ID: 3850124382-1976196219
                                                                                                                                                                                                              • Opcode ID: a40026d7ca7295af8e981d8461c14bc2ad75c9e2ef894905c23b50851bb92150
                                                                                                                                                                                                              • Instruction ID: b97585a8f8590c5d6c6dd4929484a16eb03dd4ab017d549531854e1a87dfc35a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a40026d7ca7295af8e981d8461c14bc2ad75c9e2ef894905c23b50851bb92150
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75310771F40326BBEB18AE219C4FFEE3656EF45759F062138F8C492544EEB18604C6A2
                                                                                                                                                                                                              Function 05E30C80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100memorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 05E30C89
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,05E6AA28,00000104), ref: 05E30C9F
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,05E6A710,00000208), ref: 05E30CB0
                                                                                                                                                                                                              • GetWindowsDirectoryA.KERNEL32(05E6AB30,00000104), ref: 05E30CC0
                                                                                                                                                                                                                • Part of subcall function 05E219F0: wcsrchr.MSVCRT ref: 05E219F9
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(05E6AC34), ref: 05E30CE3
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(05E6B4E4), ref: 05E30CEA
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(05E6A710,00000000,00000004), ref: 05E30DA5
                                                                                                                                                                                                                • Part of subcall function 05E2A150: memset.MSVCRT ref: 05E2A170
                                                                                                                                                                                                                • Part of subcall function 05E2A150: GetWindowsDirectoryW.KERNEL32(?,00000208,?,?,00000000), ref: 05E2A184
                                                                                                                                                                                                                • Part of subcall function 05E2A150: _memicmp.MSVCRT ref: 05E2A1C3
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(05E6A710,00000080), ref: 05E30D96
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E9F0,00000000,00000000,00000000), ref: 05E30DED
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E30DF4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CriticalDirectoryInitializeModuleNameSectionWindows$AttributesCloseCreateHandleHeapMoveProcessThread_memicmpmemsetwcsrchr
                                                                                                                                                                                                              • String ID: %s.%S$brk$ruskill
                                                                                                                                                                                                              • API String ID: 2870590860-2269373653
                                                                                                                                                                                                              • Opcode ID: ec3d2b55098ebdad8707ff17ddbf19b70ebaf7983c8c90aa2d26ab16aee2a959
                                                                                                                                                                                                              • Instruction ID: 25914d85f3788d8680299446905fced9c4a37edf1b9ff6f5aea0c18bd37f2103
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec3d2b55098ebdad8707ff17ddbf19b70ebaf7983c8c90aa2d26ab16aee2a959
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D31AFB5FD4310EBE720ABA2AC0FF5A3BA5AB05FCDF442435F6C1A5040DEB16011DA62
                                                                                                                                                                                                              Function 05E2A880 Relevance: 22.6, APIs: 2, Strings: 13, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2A89E
                                                                                                                                                                                                                • Part of subcall function 05E27790: memset.MSVCRT ref: 05E277AE
                                                                                                                                                                                                                • Part of subcall function 05E27790: memset.MSVCRT ref: 05E277C8
                                                                                                                                                                                                                • Part of subcall function 05E27790: lstrcpyA.KERNEL32(00000000,off), ref: 05E277F0
                                                                                                                                                                                                                • Part of subcall function 05E27790: _snprintf.MSVCRT ref: 05E2780D
                                                                                                                                                                                                                • Part of subcall function 05E27790: lstrlenA.KERNEL32(00000000), ref: 05E27822
                                                                                                                                                                                                                • Part of subcall function 05E27790: lstrlenA.KERNEL32(00000000), ref: 05E27858
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2A936
                                                                                                                                                                                                                • Part of subcall function 05E27500: lstrlenA.KERNEL32(?), ref: 05E2752B
                                                                                                                                                                                                                • Part of subcall function 05E27500: _snprintf.MSVCRT ref: 05E27547
                                                                                                                                                                                                                • Part of subcall function 05E27500: _vsnprintf.MSVCRT ref: 05E27569
                                                                                                                                                                                                                • Part of subcall function 05E27500: lstrcmpA.KERNEL32(?,bdns), ref: 05E2758B
                                                                                                                                                                                                                • Part of subcall function 05E27500: StrStrIA.SHLWAPI(?,00000000), ref: 05E2759F
                                                                                                                                                                                                                • Part of subcall function 05E27500: lstrlenA.KERNEL32(?), ref: 05E275B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintfmemset$_vsnprintflstrcmplstrcpy
                                                                                                                                                                                                              • String ID: bdns$ffgrab$ftpgrab$http$httpi$iegrab$int$msg$msn$msnu$pdef$popgrab$usbi
                                                                                                                                                                                                              • API String ID: 3955240783-2907616027
                                                                                                                                                                                                              • Opcode ID: d9f8d4b3b9bebd8003a89e6b9cb64176b977d980a88f6a355fc2be48ab738d17
                                                                                                                                                                                                              • Instruction ID: e0cb233a513154944559b739918443c6069e2e98924d1f4cf5d09945b9dfc2a3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d9f8d4b3b9bebd8003a89e6b9cb64176b977d980a88f6a355fc2be48ab738d17
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6911527AFE1316B5EB74B7A04CCFF996216AB40F06F00309873C8791C4EAF12940E566
                                                                                                                                                                                                              Function 05E217E0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2180E
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E21829
                                                                                                                                                                                                              • wcsstr.MSVCRT ref: 05E21842
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 05E21888
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E21898
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000208), ref: 05E218B7
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 05E21905
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememset$lstrcmpstrstrwcsstr
                                                                                                                                                                                                              • String ID: %s.%S$bdns$block$brk$rdns
                                                                                                                                                                                                              • API String ID: 695720605-4000218262
                                                                                                                                                                                                              • Opcode ID: f6b58b555d11bcc3edf921cc79a2a541e927652a3ccdb7e5fc7fffb498db9a93
                                                                                                                                                                                                              • Instruction ID: 6227384bcb7a8b6d33cfe8531b5ff3f23d114f3618c4204625b32256562d9c13
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f6b58b555d11bcc3edf921cc79a2a541e927652a3ccdb7e5fc7fffb498db9a93
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 56512B71B043287BEB28DB55DC4FFEB77A8EB49B05F045169F8C592184EAB09604CBA1
                                                                                                                                                                                                              Function 05E210A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E210C0
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,05E6ADA0), ref: 05E210D7
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,05E6A710), ref: 05E2111D
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 05E21127
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 05E21161
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E36D88,00000000), ref: 05E21179
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,05E31335), ref: 05E21187
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 05E211A0
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E36E90,00000000), ref: 05E211B3
                                                                                                                                                                                                                • Part of subcall function 05E27700: memset.MSVCRT ref: 05E2771E
                                                                                                                                                                                                                • Part of subcall function 05E27700: _snprintf.MSVCRT ref: 05E27738
                                                                                                                                                                                                                • Part of subcall function 05E27700: lstrlenA.KERNEL32(00000000), ref: 05E27747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcpy$ByteCharMultiWidelstrcmpmemset$FileMove_snprintflstrlen
                                                                                                                                                                                                              • String ID: %s.%S$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 1230166232-1410347113
                                                                                                                                                                                                              • Opcode ID: 350eae3392b473691a80f38aa523472ef721ea86fee9352a9f042af23f751527
                                                                                                                                                                                                              • Instruction ID: 0d4dbc4be9825e5458f114793de91121af8b6b016e552f574f63a8d10415753b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 350eae3392b473691a80f38aa523472ef721ea86fee9352a9f042af23f751527
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D3109B174432877E7249A569C8BFEA376CEB84B58F000155FBC4E61C4DAF0AA40C665
                                                                                                                                                                                                              Function 05E273E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _vsnprintflstrlenmemset$_memicmp_snprintf
                                                                                                                                                                                                              • String ID: %s.%s$%s_$blk$block
                                                                                                                                                                                                              • API String ID: 3657324510-3589362310
                                                                                                                                                                                                              • Opcode ID: e5879a957b5b91f8925b5e5e1d5775c551a837f159b4c361603bbdb0afbf4569
                                                                                                                                                                                                              • Instruction ID: 552fb32b3c709ad325821767d645fb154b18c77ab6f414256a42a7520aff3b63
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e5879a957b5b91f8925b5e5e1d5775c551a837f159b4c361603bbdb0afbf4569
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79210FB2B4021D7BEB10EA59DC8AFFB37ACEF44718F4441ACFA4893141E5709E09C6A0
                                                                                                                                                                                                              Function 05E29580 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: memset$lstrcpy$CountTicksprintfstrtok
                                                                                                                                                                                                              • String ID: %s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42$GET$Mozilla/4.0$POST
                                                                                                                                                                                                              • API String ID: 3318893083-109246470
                                                                                                                                                                                                              • Opcode ID: 5063a33f3555e0bda29da0712b1713c59f3e03cec6876ff64508d1ef30670025
                                                                                                                                                                                                              • Instruction ID: 09958089104213e9f3721eb0cd9156307296c346e889ad55e54ccc50789162bb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5063a33f3555e0bda29da0712b1713c59f3e03cec6876ff64508d1ef30670025
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 59210CB6A442286BD728D665CC4FFD973ACAF98704F0061C5F3C9A2045E6B4A7C4CB60
                                                                                                                                                                                                              Function 05E28270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E28292
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E282A8
                                                                                                                                                                                                                • Part of subcall function 05E281C0: WSAStartup.WS2_32(00000202,?), ref: 05E281E3
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 05E28314
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupselect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3882035529-0
                                                                                                                                                                                                              • Opcode ID: afee6045dce09c253ac9461f8aceea7692a144ac82a0690fba2bc13e25057e99
                                                                                                                                                                                                              • Instruction ID: 72026a55e94888ce0e4a78952fbcfbe09fb0faa03cf31bbcf3ebba751c4518ab
                                                                                                                                                                                                              • Opcode Fuzzy Hash: afee6045dce09c253ac9461f8aceea7692a144ac82a0690fba2bc13e25057e99
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62A1E7B1A04314ABD734DF69D889AFBB3E9FF48314F00451EE6C987244E774A985CBA1
                                                                                                                                                                                                              Function 05E26F70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 125stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E26F91
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,HKCU\), ref: 05E26FFE
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000400), ref: 05E27017
                                                                                                                                                                                                              • _wcsnicmp.MSVCRT ref: 05E27061
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWide_wcsnicmplstrcpymemset
                                                                                                                                                                                                              • String ID: %S%s%s$%s.%s%s$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
                                                                                                                                                                                                              • API String ID: 2911520168-3007424447
                                                                                                                                                                                                              • Opcode ID: 1a8157b8819ef1fd561731e18dda7bc2b3238983038ef76ba31a7383960f3094
                                                                                                                                                                                                              • Instruction ID: da115ead828ed48fc3632995faf91f9f098d1f4a59b49bead49a6bc67f6a7cea
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a8157b8819ef1fd561731e18dda7bc2b3238983038ef76ba31a7383960f3094
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2141CFB2B40228BBDB10CF95DC4AEEE77ADFF48654F04516EF984E2200E6709900C7A5
                                                                                                                                                                                                              Function 05E2E880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84pipestringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2E8A0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 05E2E8AD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2E8D0
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 05E2E8FF
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 05E2E913
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2E91D
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D7A0,00000000,00000000,00000000), ref: 05E2E941
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2E94B
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 05E2E96E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateNamedPipe$CloseConnectErrorHandleLastThread_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: 30e44aa1$\\.\pipe\%08x_ipc
                                                                                                                                                                                                              • API String ID: 4065143564-1096776489
                                                                                                                                                                                                              • Opcode ID: 2135ee1d94912f23b3a6241c48d5d74c3b928d733b62155e448eee44cf93566f
                                                                                                                                                                                                              • Instruction ID: 5f5008a36381c3c3e9827651733c52ee99d041cc5341d3de1c20fd8f8d1fa414
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2135ee1d94912f23b3a6241c48d5d74c3b928d733b62155e448eee44cf93566f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D2105727C43297AF73066658C4FFBA7A5CAB04F14F2441A5FB85F91C0DEF065058AA8
                                                                                                                                                                                                              Function 05E27100 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 102stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _wcsnicmplstrcpymemset
                                                                                                                                                                                                              • String ID: %S%S%S$%s.%S%S$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
                                                                                                                                                                                                              • API String ID: 1531173107-4065158899
                                                                                                                                                                                                              • Opcode ID: a23beff4b4ace10f4154be93166ea67decb4d9e2f72f6430dbd07aaa27cfe056
                                                                                                                                                                                                              • Instruction ID: dacabcc704a9efb5168f7537c087c79be7b4c2f70642a9759b10a16ed5f01128
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a23beff4b4ace10f4154be93166ea67decb4d9e2f72f6430dbd07aaa27cfe056
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 323104B2F40324BADB14DE449C4FEFB336DEF98641F002159FDC5A2106E5B0A950CAB5
                                                                                                                                                                                                              Function 05E26940 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 72stringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E219F0: wcsrchr.MSVCRT ref: 05E219F9
                                                                                                                                                                                                                • Part of subcall function 05E27700: memset.MSVCRT ref: 05E2771E
                                                                                                                                                                                                                • Part of subcall function 05E27700: _snprintf.MSVCRT ref: 05E27738
                                                                                                                                                                                                                • Part of subcall function 05E27700: lstrlenA.KERNEL32(00000000), ref: 05E27747
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E269A8
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(05E36D88,05E6AC50,?,?,?,?,?,?), ref: 05E269BE
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(05E36E90,00000080,?,?,?,?,?,?), ref: 05E269D2
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(05E36E90,?,?,?,?,?,?), ref: 05E269DD
                                                                                                                                                                                                              • MoveFileExA.KERNEL32 ref: 05E269EC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A335
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A34F
                                                                                                                                                                                                                • Part of subcall function 05E2A310: memset.MSVCRT ref: 05E2A369
                                                                                                                                                                                                                • Part of subcall function 05E2A310: _vsnprintf.MSVCRT ref: 05E2A382
                                                                                                                                                                                                                • Part of subcall function 05E2A310: sprintf.MSVCRT ref: 05E2A39A
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB,%s.%s,blk,?,?,000001FE,05E30A8E), ref: 05E2A3AD
                                                                                                                                                                                                                • Part of subcall function 05E2A310: _snprintf.MSVCRT ref: 05E2A3CC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,05E274EB), ref: 05E2A3DB
                                                                                                                                                                                                                • Part of subcall function 05E2A310: sprintf.MSVCRT ref: 05E2A3EC
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A3FB
                                                                                                                                                                                                                • Part of subcall function 05E2A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 05E2A404
                                                                                                                                                                                                                • Part of subcall function 05E2A310: EnterCriticalSection.KERNEL32(05E6AC34,?,?,00000000), ref: 05E2A436
                                                                                                                                                                                                                • Part of subcall function 05E2A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 05E2A452
                                                                                                                                                                                                                • Part of subcall function 05E2A310: LeaveCriticalSection.KERNEL32(05E6AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05E2A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • autorun.inf, xrefs: 05E26970
                                                                                                                                                                                                              • %s.Blocked "%S" from creating "%S", xrefs: 05E26A24
                                                                                                                                                                                                              • pdef, xrefs: 05E26986
                                                                                                                                                                                                              • .exe, xrefs: 05E2699C
                                                                                                                                                                                                              • %s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!, xrefs: 05E26A06
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Filememset$CriticalSection_snprintfsprintf$AttributesCreateDeleteEnterLeaveMove_vsnprintflstrcmpstrstrwcsrchr
                                                                                                                                                                                                              • String ID: %s.Blocked "%S" from creating "%S"$%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!$.exe$autorun.inf$pdef
                                                                                                                                                                                                              • API String ID: 2285763329-814828592
                                                                                                                                                                                                              • Opcode ID: faa7ee48ae5bfb6fefaaad834b1052b2a4ac2360596722363f33bc798d4fdd0a
                                                                                                                                                                                                              • Instruction ID: 5605b606a74b8197ab1364d3b16db7fdcfc237c4f016844eccd86ce2c8e040f2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: faa7ee48ae5bfb6fefaaad834b1052b2a4ac2360596722363f33bc798d4fdd0a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5611A7B7FC432032EB1026A66C4FF9E36495F9199AF0C7128F9C5F1109DDB1E524D1A2
                                                                                                                                                                                                              Function 05E23C90 Relevance: 16.7, APIs: 11, Instructions: 227filepipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32 ref: 05E23DA4
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-05E37960,00000800,00000000), ref: 05E23DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 05E23E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,05E37960,00000800,00000000,?), ref: 05E23ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EF3
                                                                                                                                                                                                              • DisconnectNamedPipe.KERNEL32(?), ref: 05E23F68
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(?), ref: 05E23F7E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileNamedPipeRead$ConnectDisconnectMultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4113577031-0
                                                                                                                                                                                                              • Opcode ID: 98d079b4270a182b07bfd2e68ea39d6f64cf9ae026e711c17974453fd05f1a7b
                                                                                                                                                                                                              • Instruction ID: 7e5896d65ba6c8c2cbb0122baeeeb4964151d93cdf8f3245b335e35a5f883966
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 98d079b4270a182b07bfd2e68ea39d6f64cf9ae026e711c17974453fd05f1a7b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7691F6B4618329AFD714CF18E8C9FA6BBA8FB49308F014659F48687344DB75E950CFA0
                                                                                                                                                                                                              Function 05E29080 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 114COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E290A0
                                                                                                                                                                                                                • Part of subcall function 05E2A0F0: wcsrchr.MSVCRT ref: 05E2A0FA
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 05E29101
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememsetwcsrchr
                                                                                                                                                                                                              • String ID: %s.Blocked possible browser exploit pack call on URL '%s'$com$exe$firefox.exe$http$iexplore.exe$pdef$pif$scr
                                                                                                                                                                                                              • API String ID: 519477765-3787805686
                                                                                                                                                                                                              • Opcode ID: 66efbc26a5977ebbc555a1c6ccb58787bb5ae37c2fb1ea80d34a650d804aab97
                                                                                                                                                                                                              • Instruction ID: b46645d030feb48473da3458ca7348c02faa9038a3ff864d0fea9c5b04d57d64
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 66efbc26a5977ebbc555a1c6ccb58787bb5ae37c2fb1ea80d34a650d804aab97
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 793105B6E443246BEF20DB529C0EEA7376CAB50784F017168FCC4D6106EAB1D990C7A2
                                                                                                                                                                                                              Function 05E2B160 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 69stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E26E9C,00000000,00000000,00000000,?,?,05E26E9C), ref: 05E2B178
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,05E26E9C), ref: 05E2B186
                                                                                                                                                                                                              • lstrlenA.KERNEL32(05E26E9C,?,?,05E26E9C), ref: 05E2B18F
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2B19F
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E2B1B6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004,?,?,?,?,?,05E26E9C), ref: 05E2B1C3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,05E26E9C), ref: 05E2B1D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004,?,?,?,?,?,05E26E9C), ref: 05E2B1DC
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,05E26E9C), ref: 05E2B1E5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2B1F8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Allocstrstr$Freelstrcpyn
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1314289781-2344752452
                                                                                                                                                                                                              • Opcode ID: a73250223e7f80a7fc3d28930aefbde606ddb273934212b0036c76d10a68b724
                                                                                                                                                                                                              • Instruction ID: 2c2147583ca0aef91cab56700fc52666fd341ba354c60cf444f3499bc04e56f4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a73250223e7f80a7fc3d28930aefbde606ddb273934212b0036c76d10a68b724
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 571177B2A15318BBD710ABA6DC4EFAB7BACEF44655F004055F985E3200DD75AD00C7B0
                                                                                                                                                                                                              Function 05E2AC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 05E2AC1A
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 05E2AC3E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2AC44
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 05E2AC5E
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 05E2AC79
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(POST,00000000), ref: 05E2AC85
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2AC99
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2ACB2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 770645459-1814004025
                                                                                                                                                                                                              • Opcode ID: e46e8dbb2697b72b235dbaaa14f204bd3addb68c49b86662e2475c52c9b5f4ba
                                                                                                                                                                                                              • Instruction ID: a2881b6ea036e32994678c4ac086708478ec2862f35983d60030daca419d8ee8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e46e8dbb2697b72b235dbaaa14f204bd3addb68c49b86662e2475c52c9b5f4ba
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D921F676610318BBE7209B66EC8AEFB7F7DFB85695F144159F989E2100DA70A900C7B0
                                                                                                                                                                                                              Function 05E2A690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79processCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2A6AF
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2A6CA
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000000), ref: 05E2A6DF
                                                                                                                                                                                                              • PathAppendW.SHLWAPI(?,Internet Explorer\iexplore.exe), ref: 05E2A6F9
                                                                                                                                                                                                              • _snwprintf.MSVCRT ref: 05E2A71B
                                                                                                                                                                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 05E2A77F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Pathmemset$AppendCreateFolderProcessSpecial_snwprintf
                                                                                                                                                                                                              • String ID: "%s" %S$D$Internet Explorer\iexplore.exe
                                                                                                                                                                                                              • API String ID: 1165436438-694066683
                                                                                                                                                                                                              • Opcode ID: 44694eba2a8e9f4d9b6ff95ca53033d9d9087224d4acf4ab11986f4131731ba7
                                                                                                                                                                                                              • Instruction ID: cfd4aca8e4e026c85984211629131474bb860b2e932d2d024069408bd66a8e95
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44694eba2a8e9f4d9b6ff95ca53033d9d9087224d4acf4ab11986f4131731ba7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9421FD71A54308BAEB10DBE0CC4FFEA7378AF44B01F145188F6496A0C4EBF59A44CB99
                                                                                                                                                                                                              Function 05E29430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E29300: inet_addr.WS2_32(05E2226E), ref: 05E29308
                                                                                                                                                                                                                • Part of subcall function 05E29300: gethostbyname.WS2_32(05E2226E), ref: 05E29313
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E29467
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 05E29490
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 05E294BD
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E294C1
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000002,00000011), ref: 05E294F6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 05E29511
                                                                                                                                                                                                              • sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 05E2953C
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 05E29549
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 05E29559
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 05E29564
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2400900511-0
                                                                                                                                                                                                              • Opcode ID: 276a98a6a15a5a1f5037cb7d8c1f9fd5bb0863469238b4720a1b13ef5c16b412
                                                                                                                                                                                                              • Instruction ID: a729f0411492dabac013dd64cf553c1447be80b2fc6a5ef538aef38c81333a23
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 276a98a6a15a5a1f5037cb7d8c1f9fd5bb0863469238b4720a1b13ef5c16b412
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72312972B002386BD710ABF9884EBFEB2999F88704F013525F9C5E7185D5B49D45CBB1
                                                                                                                                                                                                              Function 05E2ACD0 Relevance: 15.1, APIs: 10, Instructions: 107memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2ACF5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 05E2AD0A
                                                                                                                                                                                                              • InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 05E2AD2B
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E2AD31
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 05E2AD4F
                                                                                                                                                                                                              • InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 05E2AD63
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 05E2AD80
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 05E2AD93
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000000), ref: 05E2ADB3
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2ADE6
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocInternetOptionQuery$??2@ByteCharErrorFreeLastMultiWidelstrcpymemset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3155763378-0
                                                                                                                                                                                                              • Opcode ID: 8e8fc8a2be5b6d31b3a1ab55f3d54f59bde0762a5ebfbe6ad7f51efa07644ebd
                                                                                                                                                                                                              • Instruction ID: 0ccd325dd75e431e96dd93b1f4344c88349f7da920d853edf612ef26d2383625
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e8fc8a2be5b6d31b3a1ab55f3d54f59bde0762a5ebfbe6ad7f51efa07644ebd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A31B0B5604318FBE720DB55CC89FAB7BB9EF85759F104158F984A7280DBB0A940CBA1
                                                                                                                                                                                                              Function 05E29330 Relevance: 15.1, APIs: 10, Instructions: 81networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E29300: inet_addr.WS2_32(05E2226E), ref: 05E29308
                                                                                                                                                                                                                • Part of subcall function 05E29300: gethostbyname.WS2_32(05E2226E), ref: 05E29313
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 05E2935D
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 05E2936F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E29373
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000000), ref: 05E293A6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 05E293C1
                                                                                                                                                                                                              • connect.WS2_32(?,?,00000010), ref: 05E293DE
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 05E293EB
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 05E293F8
                                                                                                                                                                                                              • Sleep.KERNEL32(0000004B,?), ref: 05E29405
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E29407
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleep$closesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1090714710-0
                                                                                                                                                                                                              • Opcode ID: e13daed2c34a58221da83955522f305e79afec8d4cd14372b833257683d4076c
                                                                                                                                                                                                              • Instruction ID: 146eaf2e5256e28efda8fe16877dd2c70063df76390094f3f7bff792d3fbcd1a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e13daed2c34a58221da83955522f305e79afec8d4cd14372b833257683d4076c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8210872A002286BDB20FBB9DD4EB9EB769AF84714F012215E988E7184D6709D41CB91
                                                                                                                                                                                                              Function 05E2FC90 Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 57stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2FCB0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 05E2FCBD
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2FCE0
                                                                                                                                                                                                              • lstrcpyW.KERNEL32(05E6B9A0,05E6ADA0), ref: 05E2FCF2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6BDB0,RECYCLED), ref: 05E2FD08
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6BEB4,?), ref: 05E2FD16
                                                                                                                                                                                                                • Part of subcall function 05E2F9E0: memset.MSVCRT ref: 05E2F9FF
                                                                                                                                                                                                                • Part of subcall function 05E2F9E0: GetLogicalDriveStringsA.KERNEL32 ref: 05E2FA22
                                                                                                                                                                                                                • Part of subcall function 05E2F9E0: lstrcatA.KERNEL32(00000000,05E33040), ref: 05E2FA5C
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: RegisterClassExA.USER32 ref: 05E2FC05
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: CreateWindowExA.USER32 ref: 05E2FC20
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: RegisterDeviceNotificationA.USER32(00000000,00000020,00000000), ref: 05E2FC30
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: GetMessageA.USER32 ref: 05E2FC48
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: TranslateMessage.USER32(?), ref: 05E2FC61
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: DispatchMessageA.USER32(?), ref: 05E2FC67
                                                                                                                                                                                                                • Part of subcall function 05E2FB60: GetMessageA.USER32 ref: 05E2FC74
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 05E2FD61
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$lstrcpy$Registermemset$ClassCreateDeviceDispatchDriveLogicalNotificationSleepStringsTranslateWindow_snprintflstrcatlstrlen
                                                                                                                                                                                                              • String ID: %0x.exe$30e44aa1$RECYCLED
                                                                                                                                                                                                              • API String ID: 496236647-684435549
                                                                                                                                                                                                              • Opcode ID: f98a30233ff70b53248ae3bd9f338c581c48f1a934645ccc7ad34c920c9bd6f2
                                                                                                                                                                                                              • Instruction ID: e3505b4763e5ca31f2e94f4324c5e7aa87f8846e4cb6a6904cf99d7db52517a9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f98a30233ff70b53248ae3bd9f338c581c48f1a934645ccc7ad34c920c9bd6f2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D1154F1A50328AFD710AF66AC8BAA67B6CA7147C8F40505AF6C4D2145DBF05984CF61
                                                                                                                                                                                                              Function 05E289B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E289C5
                                                                                                                                                                                                              • AcquireCredentialsHandleW.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 05E28A32
                                                                                                                                                                                                              • QueryContextAttributesW.SECUR32(?,00000004,00000001), ref: 05E28AC3
                                                                                                                                                                                                              • InitializeSecurityContextW.SECUR32(?,00000000,?,0008C11C,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 05E28A79
                                                                                                                                                                                                                • Part of subcall function 05E28760: FreeContextBuffer.SECUR32(?), ref: 05E28774
                                                                                                                                                                                                                • Part of subcall function 05E28790: InitializeSecurityContextW.SECUR32(?,?,?,0008C11C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 05E288AE
                                                                                                                                                                                                              • DeleteSecurityContext.SECUR32(?), ref: 05E28B17
                                                                                                                                                                                                              • FreeCredentialsHandle.SECUR32(?), ref: 05E28B1E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Context$Security$CredentialsFreeHandleInitialize$AcquireAttributesBufferDeleteQuerymemset
                                                                                                                                                                                                              • String ID: $Microsoft Unified Security Protocol Provider
                                                                                                                                                                                                              • API String ID: 3657786480-3891800672
                                                                                                                                                                                                              • Opcode ID: 80300e6774798a2b0b29f27da349d5b1d4d5f4b43e4b62cf79cfeee2b71a6e27
                                                                                                                                                                                                              • Instruction ID: b91b1ead4bc7751a12b5ddd3b10fbe38e2d890abc449a23d5ef259cc71afc53c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 80300e6774798a2b0b29f27da349d5b1d4d5f4b43e4b62cf79cfeee2b71a6e27
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 505118B1D00218ABDB20DF9AD889DAFFBF8FF94704F10551EE545E6204E7B5A605CB60
                                                                                                                                                                                                              Function 05E21D10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E21D31
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E21D4B
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 05E21D9B
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E21DAB
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000400), ref: 05E21DCA
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000200,00000000,00000000), ref: 05E21E0C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememset$lstrcmpstrstr
                                                                                                                                                                                                              • String ID: bdns$block
                                                                                                                                                                                                              • API String ID: 1883446694-4143068083
                                                                                                                                                                                                              • Opcode ID: 8523fc2d6f3f6c3731182132a890e8b3f56125d74a7378296cc502bfb8fda5cd
                                                                                                                                                                                                              • Instruction ID: 60c4e5d26edc75005b758ff49b1d581f3305b36d718a11463706ac93e15417ab
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8523fc2d6f3f6c3731182132a890e8b3f56125d74a7378296cc502bfb8fda5cd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 033138B6B44318BBEB24DA55DC0EFFB336CEF84715F004159FA55A61C4EAB09A10C6B2
                                                                                                                                                                                                              Function 05E21000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,05E6AC50), ref: 05E2100D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,05E6AA28), ref: 05E21054
                                                                                                                                                                                                              • MoveFileExA.KERNEL32 ref: 05E21062
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E36D88,?), ref: 05E2108B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E36E90,?), ref: 05E21093
                                                                                                                                                                                                                • Part of subcall function 05E27700: memset.MSVCRT ref: 05E2771E
                                                                                                                                                                                                                • Part of subcall function 05E27700: _snprintf.MSVCRT ref: 05E27738
                                                                                                                                                                                                                • Part of subcall function 05E27700: lstrlenA.KERNEL32(00000000), ref: 05E27747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: %s.%s$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 4105673886-2574534833
                                                                                                                                                                                                              • Opcode ID: 9a2fab4b386d18be78b129e1c9fc86d82a31af9aa19a94b551326143c9c9d7b0
                                                                                                                                                                                                              • Instruction ID: f0090c83d1140338db5fdaa594c0f7a90146e022afea18981de1e1bc6a7647bd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a2fab4b386d18be78b129e1c9fc86d82a31af9aa19a94b551326143c9c9d7b0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 59012876740324B7E3246A6AEC4EEEB3B8DEF885A9B042029F6C8D1005DAB0C501D273
                                                                                                                                                                                                              Function 05E29C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E29C7C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E29C9A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(05E6B648,05E31335), ref: 05E29CB3
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(05E6B648,00000000,00000200), ref: 05E29CC4
                                                                                                                                                                                                              • strtok.MSVCRT ref: 05E29CDB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 05E29CE8
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E29D73
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [Slowloris]: Finished flood on "%s", xrefs: 05E29D45
                                                                                                                                                                                                              • [Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 05E29CF9
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
                                                                                                                                                                                                              • String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
                                                                                                                                                                                                              • API String ID: 1726920797-1250431664
                                                                                                                                                                                                              • Opcode ID: b1a24bdc39e3b65df50d0ef12e011b32f0078792ab131f8db12bca32bab28918
                                                                                                                                                                                                              • Instruction ID: 14c5a3bd83be6fc86878da3d55b649b3090d06de3d85ccd9ad88ae8a7e71fe28
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b1a24bdc39e3b65df50d0ef12e011b32f0078792ab131f8db12bca32bab28918
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D21FCB27943186BE310ABA2EC4FF6B3B9CE7447DDF006029F6C4D6245DAB15444DBA0
                                                                                                                                                                                                              Function 05E30BB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,GetAddrInfoW), ref: 05E30C14
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,send), ref: 05E30C26
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _stricmp
                                                                                                                                                                                                              • String ID: GetAddrInfoW$dnsapi.dll$nspr4.dll$send$wininet.dll
                                                                                                                                                                                                              • API String ID: 2884411883-3553644081
                                                                                                                                                                                                              • Opcode ID: e7ecd064101ff80ac3a0af2911e96cfbc972eee2c170d49cd64b561a94b21977
                                                                                                                                                                                                              • Instruction ID: f05d729cbeca380a506b7df9679218ae704657261f54ed37d8eafb599e838da3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7ecd064101ff80ac3a0af2911e96cfbc972eee2c170d49cd64b561a94b21977
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6511C433F4013022EF2163AA7D0FFAAA28D6F2467BF052532EDC9D3210E995D550D2E2
                                                                                                                                                                                                              Function 05E2C8C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,http.set,?,msn.int,?,05E357F4,?,05E357F0,?,speed,?,rs0,?,stats), ref: 05E2C8DD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,http.set,?,msn.int,?,05E357F4,?,05E357F0,?,speed,?,rs0,?,stats), ref: 05E2C8E5
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,05E32C78,?,?,http.set,?,msn.int,?,05E357F4,?,05E357F0,?,speed,?,rs0), ref: 05E2C907
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?,?,?,http.set,?,msn.int,?,05E357F4,?,05E357F0,?,speed,?,rs0), ref: 05E2C913
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,http.int,?,http.set,?,msn.int,?,05E357F4,?,05E357F0,?,speed,?,rs0,?,stats), ref: 05E2C985
                                                                                                                                                                                                              • atoi.MSVCRT(?,?,?,http.set,?,msn.int,?,05E357F4,?,05E357F0,?,speed,?,rs0,?,stats), ref: 05E2C99C
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 05E2C9AF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: atoilstrcatlstrlen$lstrcmp
                                                                                                                                                                                                              • String ID: [HTTP]: Updated HTTP spread message to "%s"$http$msg
                                                                                                                                                                                                              • API String ID: 3861295430-3390247340
                                                                                                                                                                                                              • Opcode ID: 1482b23bbe626e105ecd1bbf882e30331153fe356e12343fa867aa0e7af8a495
                                                                                                                                                                                                              • Instruction ID: 3acf8b3bde6cc1228f225799102f41b3f1fae251843b755352bb7b015ad89685
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1482b23bbe626e105ecd1bbf882e30331153fe356e12343fa867aa0e7af8a495
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63016175A0421CAEDB24DF64CC89EDAB379AF44204F2054DAD5C993005EF71FA86CF60
                                                                                                                                                                                                              Function 05E23DB8 Relevance: 12.1, APIs: 8, Instructions: 108fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-05E37960,00000800,00000000), ref: 05E23DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 05E23E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,05E37960,00000800,00000000,?), ref: 05E23ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EF3
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32 ref: 05E23F0D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF), ref: 05E23F1D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 146293752-0
                                                                                                                                                                                                              • Opcode ID: 271c086b89354eac0bdcd4ad61b861402ddbba723fb79fb3956590c16edebc14
                                                                                                                                                                                                              • Instruction ID: bfe4cbe5d8cb93722c9820b2c4c4c8950b12785ae4e6b8a243f6e38c51cd05c7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 271c086b89354eac0bdcd4ad61b861402ddbba723fb79fb3956590c16edebc14
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F141D4B4604329AFD704CF68D8C9FAA7B68FF49348F414648F58687285DB31E915CFA1
                                                                                                                                                                                                              Function 05E23DB6 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-05E37960,00000800,00000000), ref: 05E23DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 05E23E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,05E37960,00000800,00000000,?), ref: 05E23ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23EF3
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32 ref: 05E23F0D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF), ref: 05E23F1D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 146293752-0
                                                                                                                                                                                                              • Opcode ID: 8c6958dcfc624a7cc641fea64012f43b51ded0b3518b543032785a0d98f0b699
                                                                                                                                                                                                              • Instruction ID: 8abc2bed47109a99d907540cfe5bbfd7612dc969ecfc8c1efd087df6e46bfd4c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c6958dcfc624a7cc641fea64012f43b51ded0b3518b543032785a0d98f0b699
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D041D4B4204329AFD704CF68D8C9FAA7B68FF49348F414A48F58687285DB35E911CFA0
                                                                                                                                                                                                              Function 05E27500 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 99stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintf_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 3897371274-741241040
                                                                                                                                                                                                              • Opcode ID: 2c2ed51edb48d63d426645ebc898edc6955927979aca6a47f7e04ff9ce68bc13
                                                                                                                                                                                                              • Instruction ID: e653e48daf7e7f1a136c0d62cd1dd4a39de9b350983e748c0602c6d055a20c89
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c2ed51edb48d63d426645ebc898edc6955927979aca6a47f7e04ff9ce68bc13
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E321B6727442296BEB209E69AC8DFEBBB6CFB44658F04156DBDC9D3104EA30D900C6E1
                                                                                                                                                                                                              Function 05E28670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103C), ref: 05E28688
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 05E286AE
                                                                                                                                                                                                              • inet_ntoa.WS2_32(?), ref: 05E286F7
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 05E28704
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 05E28713
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,05E28640,00000000,00000000,00000000), ref: 05E28734
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2873B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 30336511-0
                                                                                                                                                                                                              • Opcode ID: 77a833fca4c85233d34b22268437784e5cbd34d8f82e1b98ce7e2c8225fe922f
                                                                                                                                                                                                              • Instruction ID: 1494f8f1473cf546f1d16280fd479fa273fdf93611266a97e62276f9b45ea93c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77a833fca4c85233d34b22268437784e5cbd34d8f82e1b98ce7e2c8225fe922f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C21F375A187209AE3205B71D80EBDA7AA8BF08789F00552DF5DAD6284DBB0A140CB54
                                                                                                                                                                                                              Function 05E27790 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 69stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlenmemset$_snprintflstrcpy
                                                                                                                                                                                                              • String ID: off$state_%s
                                                                                                                                                                                                              • API String ID: 1009457118-628336787
                                                                                                                                                                                                              • Opcode ID: ef0eefdb90638c97339e1c442f45066c4b2fc9ccfed2d6fcef48d361e76bd645
                                                                                                                                                                                                              • Instruction ID: 06db2260fc81ccadcc22a3374d58207b0f4a4d751ebbec1a3800440aed87899d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef0eefdb90638c97339e1c442f45066c4b2fc9ccfed2d6fcef48d361e76bd645
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3211D6B6A4132877D724E655CD4EFEA336CDB54704F0051D8FBC866181EAF06B84CAA1
                                                                                                                                                                                                              Function 05E27F90 Relevance: 10.6, APIs: 7, Instructions: 131networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 05E27FD4
                                                                                                                                                                                                              • send.WS2_32(?,?,?,00000000), ref: 05E27FFB
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,00000000,?), ref: 05E28004
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,00000000,00000001,?), ref: 05E2803D
                                                                                                                                                                                                              • select.WS2_32(00000000,?,00000000,00000000,?), ref: 05E28081
                                                                                                                                                                                                              • recv.WS2_32(?,?,00001000,00000000), ref: 05E2809A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: select$FreeLocalrecvsend
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1822081929-0
                                                                                                                                                                                                              • Opcode ID: 80213f6e90d3c2012163d27a18e2b0b41e4504c43c96761670e0fee8569b5ac5
                                                                                                                                                                                                              • Instruction ID: 75fb6a40d9e30c23de028cb99497a4934efc52a13bc9821ac140f8dc9eba91d5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 80213f6e90d3c2012163d27a18e2b0b41e4504c43c96761670e0fee8569b5ac5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 59416E716007149BE730DF59DC85FE6B3F8EB88714F00468EF5899B680D7F5A9848B91
                                                                                                                                                                                                              Function 05E22A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 05E22A44
                                                                                                                                                                                                                • Part of subcall function 05E22460: GetProcessHeap.KERNEL32(?,05E220DE,?), ref: 05E2246C
                                                                                                                                                                                                                • Part of subcall function 05E22460: HeapAlloc.KERNEL32(?,00000008,05E220DE,?,05E220DE,?), ref: 05E2247E
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 05E22A8A
                                                                                                                                                                                                              • WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 05E22A96
                                                                                                                                                                                                              • GetLastError.KERNEL32(00000002,00000001,00000006), ref: 05E22A9B
                                                                                                                                                                                                                • Part of subcall function 05E224A0: GetProcessHeap.KERNEL32(00000000,?,05E22131,00000000), ref: 05E224B4
                                                                                                                                                                                                                • Part of subcall function 05E224A0: HeapFree.KERNEL32(?,00000000,05E22131), ref: 05E224C3
                                                                                                                                                                                                              • inet_ntoa.WS2_32(00000002), ref: 05E22AEE
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 05E22AFC
                                                                                                                                                                                                              • Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 05E22B0B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 268164981-0
                                                                                                                                                                                                              • Opcode ID: 485f4125faccea8e98df86613778754be72d1f2e776b2501f852388884a7a570
                                                                                                                                                                                                              • Instruction ID: 1c9df201047ceec5ccc4c91cc95d3e1dccc34ca5229b22d3edd008920aa8b1ac
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 485f4125faccea8e98df86613778754be72d1f2e776b2501f852388884a7a570
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CE412775F00228ABDB20DFA8D884AAFB3B6FF44324F005259E699DB344D771A941CBC1
                                                                                                                                                                                                              Function 05E26E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E22460: GetProcessHeap.KERNEL32(?,05E220DE,?), ref: 05E2246C
                                                                                                                                                                                                                • Part of subcall function 05E22460: HeapAlloc.KERNEL32(?,00000008,05E220DE,?,05E220DE,?), ref: 05E2247E
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 05E2AFBD
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 05E2AFCB
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: memset.MSVCRT ref: 05E2AFE8
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: memset.MSVCRT ref: 05E2B002
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: lstrlenA.KERNEL32(?), ref: 05E2B013
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: sscanf.MSVCRT ref: 05E2B02A
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: strtok.MSVCRT ref: 05E2B041
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: _memicmp.MSVCRT ref: 05E2B05B
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: strtok.MSVCRT ref: 05E2B06E
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: lstrlenA.KERNEL32(00000000), ref: 05E2B09B
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: lstrlenA.KERNEL32(00000000), ref: 05E2B0AD
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: lstrlenA.KERNEL32(00000000), ref: 05E2B0BB
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: lstrlenA.KERNEL32(00000000), ref: 05E2B0C6
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: HeapAlloc.KERNEL32(?,00000000,?), ref: 05E2B0D5
                                                                                                                                                                                                                • Part of subcall function 05E2AFA0: _memicmp.MSVCRT ref: 05E2B0EB
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E26EBC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 05E26EC9
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?), ref: 05E26EE7
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E26F1A
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E26F2C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E26F3C
                                                                                                                                                                                                                • Part of subcall function 05E2B160: lstrlenA.KERNEL32(05E26E9C,00000000,00000000,00000000,?,?,05E26E9C), ref: 05E2B178
                                                                                                                                                                                                                • Part of subcall function 05E2B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,05E26E9C), ref: 05E2B186
                                                                                                                                                                                                                • Part of subcall function 05E2B160: lstrlenA.KERNEL32(05E26E9C,?,?,05E26E9C), ref: 05E2B18F
                                                                                                                                                                                                                • Part of subcall function 05E2B160: strstr.MSVCRT ref: 05E2B19F
                                                                                                                                                                                                                • Part of subcall function 05E2B160: strstr.MSVCRT ref: 05E2B1B6
                                                                                                                                                                                                                • Part of subcall function 05E2B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,05E26E9C), ref: 05E2B1C3
                                                                                                                                                                                                                • Part of subcall function 05E2B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,05E26E9C), ref: 05E2B1D2
                                                                                                                                                                                                                • Part of subcall function 05E2B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,05E26E9C), ref: 05E2B1DC
                                                                                                                                                                                                                • Part of subcall function 05E2B160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,05E26E9C), ref: 05E2B1E5
                                                                                                                                                                                                                • Part of subcall function 05E2B160: HeapFree.KERNEL32(?,00000000,00000000), ref: 05E2B1F8
                                                                                                                                                                                                                • Part of subcall function 05E301E0: memset.MSVCRT ref: 05E30202
                                                                                                                                                                                                                • Part of subcall function 05E301E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 05E30213
                                                                                                                                                                                                                • Part of subcall function 05E301E0: EnterCriticalSection.KERNEL32(05E6B4E4), ref: 05E30223
                                                                                                                                                                                                                • Part of subcall function 05E301E0: strstr.MSVCRT ref: 05E30243
                                                                                                                                                                                                                • Part of subcall function 05E301E0: lstrlenA.KERNEL32(00000000), ref: 05E30254
                                                                                                                                                                                                                • Part of subcall function 05E301E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 05E3025F
                                                                                                                                                                                                                • Part of subcall function 05E301E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 05E30272
                                                                                                                                                                                                                • Part of subcall function 05E301E0: strstr.MSVCRT ref: 05E30281
                                                                                                                                                                                                                • Part of subcall function 05E301E0: _snprintf.MSVCRT ref: 05E302C8
                                                                                                                                                                                                                • Part of subcall function 05E301E0: strstr.MSVCRT ref: 05E302EF
                                                                                                                                                                                                                • Part of subcall function 05E301E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 05E303E4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 836748388-1814004025
                                                                                                                                                                                                              • Opcode ID: 7ef68577351d007229b4eb3f52ae939acd87f790020d4b71ad18cdf271fa27ec
                                                                                                                                                                                                              • Instruction ID: ec89d8741de6c3d78195ba428c6fbcb17d9742f3dc0a08c45804348c6e407f76
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ef68577351d007229b4eb3f52ae939acd87f790020d4b71ad18cdf271fa27ec
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6431EA75A04224ABEB10DF95DC89EAF7B7CFB84298F045179F94993204DE31FA14C7A1
                                                                                                                                                                                                              Function 05E2D110 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 98stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpynlstrlenmemmovememsetstrchr
                                                                                                                                                                                                              • String ID: 332
                                                                                                                                                                                                              • API String ID: 3300951897-3855660651
                                                                                                                                                                                                              • Opcode ID: 00374cb8cbec4c86c0663efe45328d474d7d27e36c3689c1dbf208067a4954de
                                                                                                                                                                                                              • Instruction ID: 7dff53558c63d93bd8d9fa059296ac8e34c4582be14a2f6373a8f73fbe4a36e6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00374cb8cbec4c86c0663efe45328d474d7d27e36c3689c1dbf208067a4954de
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C3129B5A0032A7BEB209A29CCCDFB77B6CEF44344F0441A8F98997145E630E905CBB1
                                                                                                                                                                                                              Function 05E27610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf_vsnprintflstrcmplstrlen
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 4220314296-741241040
                                                                                                                                                                                                              • Opcode ID: b104efaebf2c0dc0a1c0faa0b333d6433f13a041840d98e8f52f84dfd60e794e
                                                                                                                                                                                                              • Instruction ID: c28e2772cfcbc9448a50b53a1fa434bcd3573a24f8bd521b5bac3cdb81c30438
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b104efaebf2c0dc0a1c0faa0b333d6433f13a041840d98e8f52f84dfd60e794e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 152106737042296BEB209E69ECC9FE77768FB44618F045569FC59D3204EA71D900C7E0
                                                                                                                                                                                                              Function 05E23B90 Relevance: 10.6, APIs: 7, Instructions: 82pipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 05E23BD8
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(?,40000001,00000000,000000FF,00010000,00010000,00000000,00000000), ref: 05E23C0F
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000,?), ref: 05E23C25
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23C2F
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 05E23C46
                                                                                                                                                                                                              • SetEvent.KERNEL32(00000000), ref: 05E23C56
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateErrorEventLastNamedPipe$Connect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3507186782-0
                                                                                                                                                                                                              • Opcode ID: 7240d970b336247dceb3f7fe463546eb14d3282310199403b17a8d710c80eadb
                                                                                                                                                                                                              • Instruction ID: 87b7d36f2dd9c8f2a8c003c187029cbf0dbdd9a19a6bbc22a41ef567cdb5562e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7240d970b336247dceb3f7fe463546eb14d3282310199403b17a8d710c80eadb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F121283534430A6FE7208F65D8C9BD97B65FF44355F204529FA8DCA180D7B4E840CB60
                                                                                                                                                                                                              Function 05E2F2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E23810: GetProcessHeap.KERNEL32(00000000,00000000,?,05E24046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 05E23819
                                                                                                                                                                                                                • Part of subcall function 05E23810: HeapAlloc.KERNEL32(00000000,?,05E24046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 05E23820
                                                                                                                                                                                                              • sprintf.MSVCRT ref: 05E2F2E9
                                                                                                                                                                                                              • CreateFileA.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000000,00000000), ref: 05E2F2FA
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2F323
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,002D1400,05E309A7,0000000C,?,00000400,00000000,00000000), ref: 05E2F352
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2F35B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocCloseControlCreateDeviceFileHandleProcessmemsetsprintf
                                                                                                                                                                                                              • String ID: \\.\%c:
                                                                                                                                                                                                              • API String ID: 2995886503-1260769427
                                                                                                                                                                                                              • Opcode ID: e0a1a34e1807192b86bc40b818c130335ce1053aeb29940d22a36803e24f5fce
                                                                                                                                                                                                              • Instruction ID: ccd8ec94a559b3d16310bcafc2dd8042b771f561018398542c2590c01e4d2ff2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e0a1a34e1807192b86bc40b818c130335ce1053aeb29940d22a36803e24f5fce
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F02198F2E0021C7BEB10DF959CCAEFE777CEB45658F0041B9F658A6240D6B40E4486A1
                                                                                                                                                                                                              Function 05E281C0 Relevance: 10.6, APIs: 7, Instructions: 61networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 05E281E3
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 05E281F9
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 05E2820F
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 05E2821A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Startupclosesocketioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3235567692-0
                                                                                                                                                                                                              • Opcode ID: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
                                                                                                                                                                                                              • Instruction ID: 0f68790b592edd289555e6c00d508d1efe4b7dd40bf4db1755a36137dce73532
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3901D67174432875EB20E6A49C0FFFE725DDF05B25F0012A4FB58AA1C0EBB15A588295
                                                                                                                                                                                                              Function 05E2A64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,05E2E750,00000000,00000000,00000000), ref: 05E2A659
                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 05E2A66F
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 05E2A678
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 05E2A680
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • ngrBot Error, xrefs: 05E2A661
                                                                                                                                                                                                              • This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 05E2A666
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateExitMessageObjectProcessSingleThreadWait
                                                                                                                                                                                                              • String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
                                                                                                                                                                                                              • API String ID: 2697768853-1169653777
                                                                                                                                                                                                              • Opcode ID: aa5ecdb8010e55d4a999a3fc44965e27029b9f4c3ee66b1bf35a65a294d3b8f6
                                                                                                                                                                                                              • Instruction ID: ae9432a92b4d3cee5be0c1aee69ef1a92c8cd56f48b51d460e5f4d0a1de02a65
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa5ecdb8010e55d4a999a3fc44965e27029b9f4c3ee66b1bf35a65a294d3b8f6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EFE09E35BDC365B7E7281AA15D1FF453D545B04F16F211244F3D5BD0C08EE02140DB59
                                                                                                                                                                                                              Function 05E27330 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 60stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: %s_
                                                                                                                                                                                                              • API String ID: 3230270962-1040268105
                                                                                                                                                                                                              • Opcode ID: 5eb4793809814b11b8942df02432e69d2d1551d721c2ba367d6c6d7a14b8370f
                                                                                                                                                                                                              • Instruction ID: 4db64b1445b8583515a54671abdeb205d370fccdd9a4ab485a155ecbd28adcdb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5eb4793809814b11b8942df02432e69d2d1551d721c2ba367d6c6d7a14b8370f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0811C872B403197BFB20E6699C8EFFB776CDF84B54F0405A8B95897181E5B09E04C7A1
                                                                                                                                                                                                              Function 05E302A9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 57memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E302C8
                                                                                                                                                                                                              • strstr.MSVCRT ref: 05E302EF
                                                                                                                                                                                                              • atoi.MSVCRT(00000000,?,http,int), ref: 05E30322
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E30386
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E303E4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 05E303EE
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6B4E4), ref: 05E303FD
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 05E3041F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$CriticalLeaveSection_snprintfatoilstrlenstrstr
                                                                                                                                                                                                              • String ID: %s=
                                                                                                                                                                                                              • API String ID: 1805118874-2646424381
                                                                                                                                                                                                              • Opcode ID: e45bc292fb84e89fd383719ea46cdfd0b93e4d7da22b7712e58adafe2829769a
                                                                                                                                                                                                              • Instruction ID: c812e2f5dc165253b8c79159887d858965198e92199e6c607ebfd73402a50290
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e45bc292fb84e89fd383719ea46cdfd0b93e4d7da22b7712e58adafe2829769a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FF11E931B44309ABEB20D651CC8EFFEB379FF84204F046069E99957100EA74BD41CB90
                                                                                                                                                                                                              Function 05E2DD20 Relevance: 9.0, APIs: 6, Instructions: 36sleepthreadnetworkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CleanupCountCriticalExitInitializeSectionSleepThreadTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 544336047-0
                                                                                                                                                                                                              • Opcode ID: 6f1e98c28104b5cbf17944e4f2cea12047990147062347c2c44d7052345fe5bb
                                                                                                                                                                                                              • Instruction ID: 8fccbdb6b6143bcb4013821faad5139ee62a157d70c7cbe7a702b55f4e0644d1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f1e98c28104b5cbf17944e4f2cea12047990147062347c2c44d7052345fe5bb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 06F096F0A58B3896E7547BB5BF0E5AD3A146F4016CB202714F7D2C11D8FF749102C992
                                                                                                                                                                                                              Function 05E24560 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E245D5
                                                                                                                                                                                                              • CreateFileMappingA.KERNEL32 ref: 05E245FD
                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,?,00010000,EDB88320,00000000), ref: 05E24636
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateMappingView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 1261873476-1933919280
                                                                                                                                                                                                              • Opcode ID: 7a290fb83f9168df1bfca0818ae082ea94ec8f08048b7bc8d5ce1290a4e001ea
                                                                                                                                                                                                              • Instruction ID: 6b55d6a24b5cced861e82fc37c5a6767a0538e9ea5af3baae3f841475586a9f0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a290fb83f9168df1bfca0818ae082ea94ec8f08048b7bc8d5ce1290a4e001ea
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8761D3726446029BD725CF18D885B75B7E5FF84308F18817CE6C68B3C5DB79A8A4DB80
                                                                                                                                                                                                              Function 05E2E4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79sleepmemorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E29FF0: strtok.MSVCRT ref: 05E2A013
                                                                                                                                                                                                                • Part of subcall function 05E29FF0: strtok.MSVCRT ref: 05E2A04F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2E517
                                                                                                                                                                                                              • _memicmp.MSVCRT ref: 05E2E525
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 05E2E54E
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 05E2E57A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strtok$FreeHeapSleep_memicmplstrlen
                                                                                                                                                                                                              • String ID: [Login]: %s
                                                                                                                                                                                                              • API String ID: 2470415281-2266835287
                                                                                                                                                                                                              • Opcode ID: 65efbd79c1402fb6d67f474c32f633b840604ca0057a25c9d8af2784e05dbd41
                                                                                                                                                                                                              • Instruction ID: 29297a516c489c4f137505db269b5f9d8e3a82cde867fe2fdb576ceb8fb8cc65
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 65efbd79c1402fb6d67f474c32f633b840604ca0057a25c9d8af2784e05dbd41
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C82101B5650324ABE720DA45DC8AFBB77ACEF88744F10542CF9C543244FBB4A940CAA1
                                                                                                                                                                                                              Function 05E21C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 05E21C6E
                                                                                                                                                                                                                • Part of subcall function 05E23750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 05E2376B
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 05E21CC6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E21CD9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$AddressCloseFileModuleProcedureWrite
                                                                                                                                                                                                              • String ID: CreateFileW$kernel32.dll
                                                                                                                                                                                                              • API String ID: 2185083974-2113957990
                                                                                                                                                                                                              • Opcode ID: 5d74329e77df5dfdcee076c5cb133fa4fdb6e40ff39a069c0ec58eb15665ddcd
                                                                                                                                                                                                              • Instruction ID: 23535acf12a794d2791bee00599f84324472128086167ff67fb02a5502a89090
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5d74329e77df5dfdcee076c5cb133fa4fdb6e40ff39a069c0ec58eb15665ddcd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27016BB16042287FE70C9F69DC8BFFB335DAB49228F104218F995A31C0D6705E04C3A0
                                                                                                                                                                                                              Function 05E216F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstr$lstrcmp
                                                                                                                                                                                                              • String ID: bdns$block
                                                                                                                                                                                                              • API String ID: 142677638-4143068083
                                                                                                                                                                                                              • Opcode ID: 357a2a2d958089976ebb0d0554ceb93038f2ade92391cb48d0693e257a8aa621
                                                                                                                                                                                                              • Instruction ID: 63c53513568627b21a27be2cb7bb90df8042dce2f712a0c766f4df05f7321d32
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 357a2a2d958089976ebb0d0554ceb93038f2ade92391cb48d0693e257a8aa621
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4621C177A042186B9B18DE59EC4ADBF33ACEBD9615F04511AFC4293200EB70EA11D6B1
                                                                                                                                                                                                              Function 05E27E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103A), ref: 05E27E2C
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 05E27E63
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 05E27E7A
                                                                                                                                                                                                              • connect.WS2_32(?,00000008,00000010), ref: 05E27E8B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocLocalconnectioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3721573447-0
                                                                                                                                                                                                              • Opcode ID: bdf45bad61944fc9b9ca31a4d065a9cbdfbc659ebeecca2cb4d2ec2856bffb45
                                                                                                                                                                                                              • Instruction ID: 0796cedb1cc478b6482edc89ad4760752cef476c1fb5ff53d79934ee86e338a6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bdf45bad61944fc9b9ca31a4d065a9cbdfbc659ebeecca2cb4d2ec2856bffb45
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2611E631B00314AFD720DF69D80DED6B7A8EF49724F00469EFA999B390D6B1A854CB90
                                                                                                                                                                                                              Function 05E2E770 Relevance: 7.6, APIs: 5, Instructions: 50registrystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 05E2E77C
                                                                                                                                                                                                              • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000012,?), ref: 05E2E793
                                                                                                                                                                                                              • RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 05E2E7B5
                                                                                                                                                                                                              • RegNotifyChangeKeyValue.ADVAPI32 ref: 05E2E7C3
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 05E2E7D1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ChangeCloseNotifyOpenlstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2592630252-0
                                                                                                                                                                                                              • Opcode ID: 25e47e53ef013dd6a47dc3d152c7902b6a5a4fbc84fd17c98b06f8d16b7c1aa2
                                                                                                                                                                                                              • Instruction ID: 928b85eb00da588df7e03604cfcf951778c5994fc1dd096bbf6920547dd03873
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 25e47e53ef013dd6a47dc3d152c7902b6a5a4fbc84fd17c98b06f8d16b7c1aa2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F011E75354304BFE724CE66DC8AFA77BADEB88B54F10841CBA8597280DA70E800CB60
                                                                                                                                                                                                              Function 05E27700 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2771E
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E27738
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 05E27747
                                                                                                                                                                                                                • Part of subcall function 05E24900: WaitForSingleObject.KERNEL32(05E27495,000000FF,?,00000000,756F59EB,?,05E27495), ref: 05E24939
                                                                                                                                                                                                                • Part of subcall function 05E24900: ReleaseMutex.KERNEL32(?,?,05E27495), ref: 05E2497C
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,05E31A30), ref: 05E2777F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexObjectReleaseSingleWait_snprintflstrcmplstrlenmemset
                                                                                                                                                                                                              • String ID: state_%s
                                                                                                                                                                                                              • API String ID: 1716770999-3670522127
                                                                                                                                                                                                              • Opcode ID: 765175309ebb3d39153c86d5d08d3576a4fe2d0e9897d6b6aa9a0081d081a9b8
                                                                                                                                                                                                              • Instruction ID: ff862d978d866b46aaca3e2ed8285df2919aca0bf4a33395656eefb4805ad25f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 765175309ebb3d39153c86d5d08d3576a4fe2d0e9897d6b6aa9a0081d081a9b8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 670126B6A903187ADB14E6A4DD0FFF933ACCB44705F0045D8BA98A2081F9B05A04CA90
                                                                                                                                                                                                              Function 05E250F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2510F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 05E25122
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 05E2512B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-comm
                                                                                                                                                                                                              • API String ID: 3057366584-1028030816
                                                                                                                                                                                                              • Opcode ID: b4999f4d9880489ab7022ecc579f0ddac60600438ffd0b67ba5d374c85c33175
                                                                                                                                                                                                              • Instruction ID: c15cfd26fd542e37a1d018e8007359577bbf679e37e9602ca6a6fd0a09fe86a1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b4999f4d9880489ab7022ecc579f0ddac60600438ffd0b67ba5d374c85c33175
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1218971AD03146BD714CA51EC4AFAB3339BB84794F042958F9C4D7142EA74DA54CFA0
                                                                                                                                                                                                              Function 05E26D90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,05E26C55,00000000), ref: 05E26DA1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                                                                              • String ID: NtQueryInformationProcess$NtSetInformationProcess$ntdll.dll
                                                                                                                                                                                                              • API String ID: 4139908857-4148885600
                                                                                                                                                                                                              • Opcode ID: a44995df14e8be92393331e6c7f83622501ddb29f21c6e83e92898ed96712d84
                                                                                                                                                                                                              • Instruction ID: 171474fa5e9435b41721116124b46084b5a57386b14774b12f473d7d77e07cc7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a44995df14e8be92393331e6c7f83622501ddb29f21c6e83e92898ed96712d84
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A901D4B234532837EB205589DC4AFEA739CDB8966DF000256FE48A7240DAB19900D6E0
                                                                                                                                                                                                              Function 05E2FAA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProcWindowsprintf
                                                                                                                                                                                                              • String ID: %c:\$[USB]: Infected %s
                                                                                                                                                                                                              • API String ID: 3179433310-2800184719
                                                                                                                                                                                                              • Opcode ID: daa9f46ca644417df3f54fd46f671238eda9d675dd657b7c81b4e69a74514ff2
                                                                                                                                                                                                              • Instruction ID: da1012908c5a346f030c2665f2bfb7442cf14a3e76bb46b1768eae810c891e71
                                                                                                                                                                                                              • Opcode Fuzzy Hash: daa9f46ca644417df3f54fd46f671238eda9d675dd657b7c81b4e69a74514ff2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F41102F6A0011C5BDB20DE64DC5BE7B73BDFB44608F049959FE86D2205EA31E911DB60
                                                                                                                                                                                                              Function 05E25070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 05E2508F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 05E250A2
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 05E250AB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-pid
                                                                                                                                                                                                              • API String ID: 3057366584-2694366501
                                                                                                                                                                                                              • Opcode ID: 2c205800ae7987fd75db06a2228d3f3f5e5dd3d172e0ad92588196015ea9f37f
                                                                                                                                                                                                              • Instruction ID: c42b0d4973ad494f0334cba738a7a759255a501a8657e3f80a117074f5dc6ac8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c205800ae7987fd75db06a2228d3f3f5e5dd3d172e0ad92588196015ea9f37f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75F09EB1B5431467FB10EA719D8FFA73258E700719F10269AFBC4950C0FDF04194CAA2
                                                                                                                                                                                                              Function 05E2D760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E27700: memset.MSVCRT ref: 05E2771E
                                                                                                                                                                                                                • Part of subcall function 05E27700: _snprintf.MSVCRT ref: 05E27738
                                                                                                                                                                                                                • Part of subcall function 05E27700: lstrlenA.KERNEL32(00000000), ref: 05E27747
                                                                                                                                                                                                              • Sleep.KERNEL32(00001388), ref: 05E2D78A
                                                                                                                                                                                                              • Sleep.KERNEL32(00002710), ref: 05E2D795
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 05E2D799
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Sleep$ExitProcess_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: bsod
                                                                                                                                                                                                              • API String ID: 706155222-1315366068
                                                                                                                                                                                                              • Opcode ID: f8da85b3330e61449f41a68b3f42ac6685a6323d8b00dd5defbfcca499b6af18
                                                                                                                                                                                                              • Instruction ID: 2c4cc7305028781f6ae53d6c75c03851eb7f1d6451cb6ae43bcc1bbb7ffcfcf5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8da85b3330e61449f41a68b3f42ac6685a6323d8b00dd5defbfcca499b6af18
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 61D0A7B399833463E32123765C0FF9B5C70EF40F76F161250FAC6AB18899D42942C4E6
                                                                                                                                                                                                              Function 05E2E840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E27330: memset.MSVCRT ref: 05E27351
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(?), ref: 05E27369
                                                                                                                                                                                                                • Part of subcall function 05E27330: _snprintf.MSVCRT ref: 05E27381
                                                                                                                                                                                                                • Part of subcall function 05E27330: _vsnprintf.MSVCRT ref: 05E273A3
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(00000000), ref: 05E273B2
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 05E2E861
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2E868
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: admin$isadmin
                                                                                                                                                                                                              • API String ID: 3136305548-1977506819
                                                                                                                                                                                                              • Opcode ID: be869197ca7b10d5be7f218d9b566785b0e0eb8f530d956051e729b6908bd0cc
                                                                                                                                                                                                              • Instruction ID: 57eb9c43b592ab7a9e90389df06a2a379112a00b2b139735af1a38658b50e1d2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: be869197ca7b10d5be7f218d9b566785b0e0eb8f530d956051e729b6908bd0cc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6D0CA7ABE830476E32027A1AE0FF052A546B24F0AF206420BBC0A90C4A9F43000A9A9
                                                                                                                                                                                                              Function 05E22880 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E22460: GetProcessHeap.KERNEL32(?,05E220DE,?), ref: 05E2246C
                                                                                                                                                                                                                • Part of subcall function 05E22460: HeapAlloc.KERNEL32(?,00000008,05E220DE,?,05E220DE,?), ref: 05E2247E
                                                                                                                                                                                                              • inet_addr.WS2_32(00000001), ref: 05E228BE
                                                                                                                                                                                                              • DnsQuery_A.DNSAPI(00000001,00000001,00000008,00000000,00000001,00000000), ref: 05E22939
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,00000001,00000001,?,00000000,00000001,00000006), ref: 05E2294E
                                                                                                                                                                                                              • DnsFree.DNSAPI(00000001,00000001), ref: 05E229D9
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeProcessQuery__stricmpinet_addr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3002912770-0
                                                                                                                                                                                                              • Opcode ID: a552d893492c252ddc3a2386bb51b113a94d4b07fac4df06bab940115e5ea3b5
                                                                                                                                                                                                              • Instruction ID: 9252b669a8faad9f07a10e78bb6fe228d814db7a40c61b84bb6f9cb106b9c97e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a552d893492c252ddc3a2386bb51b113a94d4b07fac4df06bab940115e5ea3b5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1E51C1787002149FE720DF58C884B6AB3B5FF89708F545459E6C69B388EB71F941CBA1
                                                                                                                                                                                                              Function 05E2D530 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 121sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 05E2D5E4
                                                                                                                                                                                                                • Part of subcall function 05E28F50: ApplyControlToken.SECUR32(?,?), ref: 05E28FB5
                                                                                                                                                                                                                • Part of subcall function 05E28F50: InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 05E28FF9
                                                                                                                                                                                                                • Part of subcall function 05E28F50: DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 05E29025
                                                                                                                                                                                                                • Part of subcall function 05E28F50: FreeCredentialsHandle.SECUR32(?), ref: 05E2902F
                                                                                                                                                                                                              • Sleep.KERNEL32(0000000F), ref: 05E2D659
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ContextSecuritySleep$ApplyControlCredentialsDeleteFreeHandleInitializeToken
                                                                                                                                                                                                              • String ID: %s:%d$cnc
                                                                                                                                                                                                              • API String ID: 3241915987-1903477246
                                                                                                                                                                                                              • Opcode ID: 26747d4b0d4d20e2c9824091b7594b1ef9311fc3b8fe4e1b8f42eded6aca1957
                                                                                                                                                                                                              • Instruction ID: 3ca53c92bce6665b46b05a1029c1498b1260a2d03b013a4579e100246b9c39e0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 26747d4b0d4d20e2c9824091b7594b1ef9311fc3b8fe4e1b8f42eded6aca1957
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF412AB1E04228EBD710DB99DD85DAEB7BDFB84208F004155F989D7309E971ED01C7A1
                                                                                                                                                                                                              Function 05E28F50 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ApplyControlToken.SECUR32(?,?), ref: 05E28FB5
                                                                                                                                                                                                              • InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 05E28FF9
                                                                                                                                                                                                              • DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 05E29025
                                                                                                                                                                                                              • FreeCredentialsHandle.SECUR32(?), ref: 05E2902F
                                                                                                                                                                                                                • Part of subcall function 05E28760: FreeContextBuffer.SECUR32(?), ref: 05E28774
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Context$FreeSecurity$ApplyBufferControlCredentialsDeleteHandleInitializeToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 362823901-0
                                                                                                                                                                                                              • Opcode ID: a45a41fb00aec80314428b80c0ff93c439863ead403360da5c637eb8d2085ec3
                                                                                                                                                                                                              • Instruction ID: d56a401d2fa227807ec63f5dd833b2b337cba308b0c825633cf0d25c80ea95f9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a45a41fb00aec80314428b80c0ff93c439863ead403360da5c637eb8d2085ec3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB41D5B1D002199BDB10DF9AC8849EEFBFCFF98304F10550EE555E3215D7B5A6448BA4
                                                                                                                                                                                                              Function 05E249F0 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,05E273CC,05E57C98,00000000,00000000,00000010,00000000), ref: 05E24A10
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 05E24A77
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,?,00000000), ref: 05E24AA9
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,00000000), ref: 05E24ABC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexRelease$ObjectSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 257779224-0
                                                                                                                                                                                                              • Opcode ID: a25cbcdcfcff393b9a3463d2dda4f4ba6aabcb46aa64f0db79b99e5435426fa7
                                                                                                                                                                                                              • Instruction ID: 0b3a9636f9b2f564b132a8f0522bc9ecb6dd92b7b1eed0c576180d96e0cd8509
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a25cbcdcfcff393b9a3463d2dda4f4ba6aabcb46aa64f0db79b99e5435426fa7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF21B7B27091255BEF10DF69EC809AA77A9BF80658704452AFCD9C7384FB30D9418BD4
                                                                                                                                                                                                              Function 05E24900 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(05E27495,000000FF,?,00000000,756F59EB,?,05E27495), ref: 05E24939
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,05E27495), ref: 05E2497C
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(-0000FFFF,?,05E27495), ref: 05E249A5
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(05E27495,?,05E27495), ref: 05E249D1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexRelease$ObjectSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 257779224-0
                                                                                                                                                                                                              • Opcode ID: 3ea722af8fc74dca5932630425af0637b3ffe34ccdb9473e876c1a2ce29f5c40
                                                                                                                                                                                                              • Instruction ID: fe5347c3697ab3398d4a273fe601717bb7fcc59fa060e95a7d1c126725625074
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ea722af8fc74dca5932630425af0637b3ffe34ccdb9473e876c1a2ce29f5c40
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3621963120826B8FEF249F65E8447A677E9FF4036CF19156AE5C9C7184EB30D851CB90
                                                                                                                                                                                                              Function 05E211C0 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E211E1
                                                                                                                                                                                                              • GetFileAttributesA.KERNEL32(?), ref: 05E21201
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 05E21241
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 05E21261
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AttributesByteCharExitFileMultiThreadWidememset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1389112251-0
                                                                                                                                                                                                              • Opcode ID: c1f203e94e88d5f3a2a882344c9ed28be87d5cad9b4827277fac374c651d9c3f
                                                                                                                                                                                                              • Instruction ID: b23700c4ae917bb17c7e3da36b0e9dd0e6c70e4f9d01e56a2f6ad82ac73eba30
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c1f203e94e88d5f3a2a882344c9ed28be87d5cad9b4827277fac374c651d9c3f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 30218B76214218ABEB14DF55EC4EFEB3B7CEB88754F004209FD9993280DA30A911CBB1
                                                                                                                                                                                                              Function 05E2D6B0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 05E2D6FD
                                                                                                                                                                                                              • RegSetValueExW.ADVAPI32 ref: 05E2D731
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 05E2D740
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 05E2D753
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Close$CreateValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1009429713-0
                                                                                                                                                                                                              • Opcode ID: 4ce84bcec6090a903ffb43d029b14ee827bef304a5c89c45be16dd486d07ccd1
                                                                                                                                                                                                              • Instruction ID: 86bcbb4cefc67f531af00a6c7dec1dc4c84468edcb7581a284273a2837cd5665
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ce84bcec6090a903ffb43d029b14ee827bef304a5c89c45be16dd486d07ccd1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 97217575750209BBEB14CF94DD46FBB7779EB88B44F104148FA45AB284EA74FA01CB90
                                                                                                                                                                                                              Function 05E27EF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeLocal$closesocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1824021853-0
                                                                                                                                                                                                              • Opcode ID: acbf0f25c12c631b9809da81b34fdf867c756a9361d0fc07e98053a6b47dd497
                                                                                                                                                                                                              • Instruction ID: 13097128e2fbc80fbe8512f1b9587c614fa61b8e0f4bfec726d34d4b7a92d019
                                                                                                                                                                                                              • Opcode Fuzzy Hash: acbf0f25c12c631b9809da81b34fdf867c756a9361d0fc07e98053a6b47dd497
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D50121367092249FD721DE59D884CAA73A9FF8976535414AAF689CB314C731EC42CBA0
                                                                                                                                                                                                              Function 05E2A800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: 3a35bd0e70cbfc195ee1e388179db4dfcecc6d9a685038aa3532bae18449d9cd
                                                                                                                                                                                                              • Instruction ID: a549941e236636461a25db46c860dcf6264f2529cfe4bc57e8b53784cda8ac33
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3a35bd0e70cbfc195ee1e388179db4dfcecc6d9a685038aa3532bae18449d9cd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7FF02D7A30431457D714A264DC8FA9A735BDBC8765F040868F98987244FDBDDD01C5B2
                                                                                                                                                                                                              Function 05E2A790 Relevance: 6.0, APIs: 4, Instructions: 44stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: ba99a02fc0cba4bfc827f6bb5119b04f5e75055b98e8855beed6f31f55d667d4
                                                                                                                                                                                                              • Instruction ID: 7af239f1007a91a0b465a10f95931f969769aa0b470e9ff895d91fb6f188855b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ba99a02fc0cba4bfc827f6bb5119b04f5e75055b98e8855beed6f31f55d667d4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B9F08B7360023127D3306265EC8EA8BB79DEB84665F041575FD859B200E86C9A40C6F1
                                                                                                                                                                                                              Function 05E2A080 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 05E2A0A2
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 05E2A0C0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2A0CB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2A0D8
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandle$CreateWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3602564925-0
                                                                                                                                                                                                              • Opcode ID: 59680bdab2110d9506ff347afefa1db93d994c63c18255756771f2a129480701
                                                                                                                                                                                                              • Instruction ID: 2c393d3a88e050f3ee1e7f47062462a63f622c4b6e89391825cb790397c355ba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59680bdab2110d9506ff347afefa1db93d994c63c18255756771f2a129480701
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4BF0C8712143187BE3149F99DC0EFD63B68EB48758F000254FD48D72C0DAB0680487A5
                                                                                                                                                                                                              Function 05E30880 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E24900: WaitForSingleObject.KERNEL32(05E27495,000000FF,?,00000000,756F59EB,?,05E27495), ref: 05E24939
                                                                                                                                                                                                                • Part of subcall function 05E24900: ReleaseMutex.KERNEL32(?,?,05E27495), ref: 05E2497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,00000000,%s.p10-> Message to %s hijacked!,msn), ref: 05E308B1
                                                                                                                                                                                                                • Part of subcall function 05E27330: memset.MSVCRT ref: 05E27351
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(?), ref: 05E27369
                                                                                                                                                                                                                • Part of subcall function 05E27330: _snprintf.MSVCRT ref: 05E27381
                                                                                                                                                                                                                • Part of subcall function 05E27330: _vsnprintf.MSVCRT ref: 05E273A3
                                                                                                                                                                                                                • Part of subcall function 05E27330: lstrlenA.KERNEL32(00000000), ref: 05E273B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$MutexObjectReleaseSingleWait_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 1310428588-4225137719
                                                                                                                                                                                                              • Opcode ID: 77e96959457dfab3700f933eb78a3a8a7658a7bb30df81bf6be9f1928ca01131
                                                                                                                                                                                                              • Instruction ID: 3238d39977bb53cd442f18faecd5bc33ab5538830a81735fb9ad7065286dcd45
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77e96959457dfab3700f933eb78a3a8a7658a7bb30df81bf6be9f1928ca01131
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FCF02732B412283AE7206589AC0FFEF778CCB41662F001195FC48E7200E8E15D10D3F1
                                                                                                                                                                                                              Function 05E30820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 05E24900: WaitForSingleObject.KERNEL32(05E27495,000000FF,?,00000000,756F59EB,?,05E27495), ref: 05E24939
                                                                                                                                                                                                                • Part of subcall function 05E24900: ReleaseMutex.KERNEL32(?,?,05E27495), ref: 05E2497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,05E22696), ref: 05E3084B
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27401
                                                                                                                                                                                                                • Part of subcall function 05E273E0: memset.MSVCRT ref: 05E27419
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E27431
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _snprintf.MSVCRT ref: 05E27449
                                                                                                                                                                                                                • Part of subcall function 05E273E0: _vsnprintf.MSVCRT ref: 05E2746B
                                                                                                                                                                                                                • Part of subcall function 05E273E0: lstrlenA.KERNEL32(?), ref: 05E2747A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 3682388603-4225137719
                                                                                                                                                                                                              • Opcode ID: 8619768ae8628867eb0a7600e012d3edd6228f2550871f88b4590d1fff9ec7d3
                                                                                                                                                                                                              • Instruction ID: 7ed73938af5a112ca2e9024a5f7e038d0dbb2cf214f9f6be2c3dbe513b98bee1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8619768ae8628867eb0a7600e012d3edd6228f2550871f88b4590d1fff9ec7d3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 55F0EC72B9513C37D71076A8AC0FFFB768CCB05555F001191FC88E6144E9E15E10D2E1
                                                                                                                                                                                                              Function 05E2B990 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2B9AF
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(05E6A6C8,?,?,00000000), ref: 05E2B9BC
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,?,00000000), ref: 05E2B9D1
                                                                                                                                                                                                                • Part of subcall function 05E28B30: memset.MSVCRT ref: 05E28B6E
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(05E6A6C8,?,?,?,?,?,00000000), ref: 05E2B9F2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemset$EnterLeavewvsprintf
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2410102678-0
                                                                                                                                                                                                              • Opcode ID: 41383dfd6272396b91fc14c2f8301887586cce88be172e05bfd6e65b14ef7c4d
                                                                                                                                                                                                              • Instruction ID: f858ab60aafcabbe067cb1514758490f9c903a9d3d3b046fb869ac8e6aebcfb3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 41383dfd6272396b91fc14c2f8301887586cce88be172e05bfd6e65b14ef7c4d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CEF0BBB6E5421C6FC710EB54DC0EFEA7B6CEF44649F0441A9FF49A2240EA706A05CBE5
                                                                                                                                                                                                              Function 05E2E990 Relevance: 6.0, APIs: 4, Instructions: 31sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000DD20,00000000,00000000,00000000), ref: 05E2E9BF
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 05E2E9C6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 05E2E9C9
                                                                                                                                                                                                              • Sleep.KERNEL32(0000EA60), ref: 05E2E9D4
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleObjectSingleSleepThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 422747524-0
                                                                                                                                                                                                              • Opcode ID: 7c8c3699dfd3026709074355fe413eb85591647d320a3fe182205b79fbb6c172
                                                                                                                                                                                                              • Instruction ID: fa497438b7399391fd5e43f3918f0d26b1000fd323128e391ed4d8f38176d7d1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c8c3699dfd3026709074355fe413eb85591647d320a3fe182205b79fbb6c172
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 18F0EC31258228B7E7205656DC4FFA67768FB45719F24015AF3409A1C0DAA02981CAA5
                                                                                                                                                                                                              Function 05E2BA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 05E2BA1E
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,00000000,00000000), ref: 05E2BA42
                                                                                                                                                                                                                • Part of subcall function 05E2B990: memset.MSVCRT ref: 05E2B9AF
                                                                                                                                                                                                                • Part of subcall function 05E2B990: EnterCriticalSection.KERNEL32(05E6A6C8,?,?,00000000), ref: 05E2B9BC
                                                                                                                                                                                                                • Part of subcall function 05E2B990: wvsprintfA.USER32(00000000,?,00000000), ref: 05E2B9D1
                                                                                                                                                                                                                • Part of subcall function 05E2B990: LeaveCriticalSection.KERNEL32(05E6A6C8,?,?,?,?,?,00000000), ref: 05E2B9F2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemsetwvsprintf$EnterLeave
                                                                                                                                                                                                              • String ID: PPPPMSG %s :%s
                                                                                                                                                                                                              • API String ID: 3980427996-569775469
                                                                                                                                                                                                              • Opcode ID: 9cf3c12b61368ecc0dd79c476dfa7b33c5e4c2f90e655a089dfe64f15ec285fc
                                                                                                                                                                                                              • Instruction ID: ec2c7d32fddc9c23f568f8a0be7c2760059988fc37bb5c9035b676eb7ce1df5f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9cf3c12b61368ecc0dd79c476dfa7b33c5e4c2f90e655a089dfe64f15ec285fc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7F0BBB1D0410DABDF10EA54DC4AFA6377CFB44704F0481A9F88897240FE70AA48CF91
                                                                                                                                                                                                              Function 05E268B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,05E69E78,00000026,00000001), ref: 05E268BB
                                                                                                                                                                                                              • PathAppendW.SHLWAPI(05E69E78,Internet Explorer\iexplore.exe), ref: 05E268D0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • Internet Explorer\iexplore.exe, xrefs: 05E268C6
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000007.00000002.626495288.0000000005E20000.00000040.00000400.00020000.00000000.sdmp, Offset: 05E20000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_7_2_5e20000_iexplore.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Path$AppendFolderSpecial
                                                                                                                                                                                                              • String ID: Internet Explorer\iexplore.exe
                                                                                                                                                                                                              • API String ID: 2921508639-3330628412
                                                                                                                                                                                                              • Opcode ID: 7161f513f2b89508773b9e83716c28e6c44ae2c1e1e6188af6f6a41773a17c76
                                                                                                                                                                                                              • Instruction ID: 4e6cc64ca5dbd92d2151004ad49580447636cf7c11e78902d56c2c229a173355
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7161f513f2b89508773b9e83716c28e6c44ae2c1e1e6188af6f6a41773a17c76
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28C0CA363D430066EB281A25488FF912E92A764BCAF802248B5C2E8081CAF18080E102

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:3.7%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                              Total number of Nodes:200
                                                                                                                                                                                                              Total number of Limit Nodes:12
                                                                                                                                                                                                              execution_graph 5151 195c50 5157 195a20 5151->5157 5153 195c67 5154 195cd8 5153->5154 5171 1949f0 5153->5171 5156 195cc6 5158 195a2b 5157->5158 5159 195c46 5158->5159 5189 193a20 5158->5189 5159->5153 5162 195aef 5217 193080 5162->5217 5164 195b31 5165 193080 5 API calls 5164->5165 5170 195b4f 5165->5170 5166 195a3c 5166->5159 5194 194d00 5166->5194 5167 195bf4 CreateThread CloseHandle 5168 195c0c 5167->5168 5168->5159 5169 195c2e CreateThread CloseHandle 5168->5169 5169->5159 5170->5167 5170->5168 5172 194acb 5171->5172 5173 194a00 5171->5173 5172->5156 5173->5172 5174 194a0b WaitForSingleObject 5173->5174 5174->5172 5175 194a1e 5174->5175 5176 194560 8 API calls 5175->5176 5179 194a42 5176->5179 5177 194a79 5177->5156 5178 194aad ReleaseMutex 5182 194470 4 API calls 5178->5182 5179->5177 5179->5178 5358 1947c0 5179->5358 5184 194ac6 5182->5184 5183 194a6d 5185 194a80 5183->5185 5186 194a74 ReleaseMutex 5183->5186 5184->5156 5187 194470 4 API calls 5185->5187 5186->5177 5188 194a88 ReleaseMutex 5187->5188 5188->5178 5191 193a25 5189->5191 5190 193a2d 5190->5166 5191->5190 5223 1935b0 GetPEB 5191->5223 5193 193a44 5193->5166 5196 194d0e 5194->5196 5195 194d16 5195->5162 5196->5195 5197 193a20 GetPEB 5196->5197 5198 194d33 5197->5198 5199 194d3d GetVersionExA 5198->5199 5200 194d37 5198->5200 5199->5200 5201 194d56 5199->5201 5200->5162 5224 193f90 5201->5224 5203 194d5c 5230 193390 5203->5230 5205 194d7e 5239 194ae0 5205->5239 5207 194d9b 5263 193ac0 5207->5263 5209 194da6 strncpy 5210 194dd0 5209->5210 5212 194dee 5210->5212 5281 193440 5210->5281 5267 193890 5212->5267 5214 194e67 5272 194c20 5214->5272 5216 194e7e 5216->5162 5218 193890 GetPEB 5217->5218 5220 19308c 5218->5220 5219 1930bb 5219->5164 5220->5219 5347 192f90 5220->5347 5222 1930b6 5222->5164 5223->5193 5225 193f9f 5224->5225 5227 193fa6 5224->5227 5226 193890 GetPEB 5225->5226 5226->5227 5228 193890 GetPEB 5227->5228 5229 193fd1 5227->5229 5228->5229 5229->5203 5231 19339b 5230->5231 5232 1933a0 5230->5232 5231->5205 5298 1930c0 5232->5298 5235 1930c0 InitializeCriticalSection 5236 1933c3 5235->5236 5237 19342e 5236->5237 5302 1931d0 5236->5302 5237->5205 5240 194af2 5239->5240 5241 194b54 5239->5241 5240->5241 5242 194b0d strncpy sprintf CreateMutexA 5240->5242 5241->5207 5243 194b4b 5242->5243 5244 194b5c _snprintf OpenFileMappingA 5242->5244 5315 194880 5243->5315 5246 194b9d 5244->5246 5247 194b96 CloseHandle 5244->5247 5249 194ba1 5246->5249 5250 194bb4 5246->5250 5247->5246 5248 194b51 5248->5241 5324 194560 5249->5324 5309 194470 5250->5309 5253 194bbc 5255 194bc8 5253->5255 5256 194bda 5253->5256 5254 194bad 5254->5250 5257 194bd1 5254->5257 5258 194880 3 API calls 5255->5258 5259 194c08 5256->5259 5260 194bde WaitForSingleObject 5256->5260 5257->5207 5261 194bce 5258->5261 5259->5207 5260->5259 5262 194bed ReleaseMutex 5260->5262 5261->5257 5262->5259 5264 193acc 5263->5264 5265 193b10 5263->5265 5264->5265 5266 193ae0 _snprintf 5264->5266 5265->5209 5266->5209 5268 1938a0 5267->5268 5271 1938ae 5267->5271 5332 1935b0 GetPEB 5268->5332 5270 1938a5 5270->5214 5271->5214 5333 1935d0 5272->5333 5274 194c31 OpenProcessToken 5275 194c48 LookupPrivilegeValueA 5274->5275 5276 194c3c GetLastError 5274->5276 5277 194c5c GetLastError CloseHandle 5275->5277 5278 194c72 AdjustTokenPrivileges 5275->5278 5276->5216 5277->5216 5279 194ca9 CloseHandle 5278->5279 5280 194ca3 GetLastError 5278->5280 5279->5216 5280->5279 5282 19359f 5281->5282 5286 193451 5281->5286 5282->5212 5283 19348c printf printf 5287 1934c2 5283->5287 5288 1934c7 printf 5283->5288 5285 19355a 5289 193593 5285->5289 5341 193320 5285->5341 5286->5282 5286->5283 5286->5285 5287->5288 5293 1934f1 5288->5293 5289->5212 5292 1931d0 2 API calls 5292->5289 5293->5282 5334 193100 5293->5334 5295 19354a 5296 193440 6 API calls 5295->5296 5297 193551 5296->5297 5297->5212 5299 1930cb 5298->5299 5300 1930f1 5298->5300 5299->5300 5301 1930e7 InitializeCriticalSection 5299->5301 5300->5235 5301->5300 5303 1931dc 5302->5303 5304 193230 5302->5304 5303->5304 5305 1931e9 EnterCriticalSection 5303->5305 5306 1931f3 5303->5306 5304->5237 5305->5306 5307 19321d LeaveCriticalSection 5306->5307 5308 193227 5306->5308 5307->5308 5308->5237 5310 19448e _snprintf OpenFileMappingA 5309->5310 5311 194536 5309->5311 5312 194530 5310->5312 5313 1944e2 MapViewOfFile 5310->5313 5311->5253 5312->5253 5313->5311 5314 194516 CloseHandle 5313->5314 5314->5312 5316 19488b 5315->5316 5317 194890 5315->5317 5316->5248 5318 1948a4 5317->5318 5319 194897 CloseHandle 5317->5319 5320 1948b7 UnmapViewOfFile 5318->5320 5321 1948cc 5318->5321 5319->5318 5320->5318 5322 1948da CloseHandle 5321->5322 5323 1948ef 5321->5323 5322->5321 5323->5248 5325 19457a 5324->5325 5326 194470 4 API calls 5325->5326 5327 1946fd 5325->5327 5328 1945b9 _snprintf 5325->5328 5329 1945ed CreateFileMappingA 5325->5329 5326->5325 5327->5254 5328->5325 5328->5329 5329->5327 5330 194621 MapViewOfFile 5329->5330 5330->5325 5331 194706 CloseHandle 5330->5331 5331->5254 5332->5270 5333->5274 5335 193161 5334->5335 5336 19310c 5334->5336 5335->5295 5336->5335 5337 193119 EnterCriticalSection 5336->5337 5338 193123 5336->5338 5337->5338 5339 193158 5338->5339 5340 19314e LeaveCriticalSection 5338->5340 5339->5295 5340->5339 5342 193332 5341->5342 5343 193385 5341->5343 5342->5343 5344 19333c EnterCriticalSection 5342->5344 5345 193346 5342->5345 5343->5292 5344->5345 5345->5343 5346 19337b LeaveCriticalSection 5345->5346 5346->5343 5348 192fa2 5347->5348 5349 193074 5347->5349 5348->5349 5350 192fc2 ReadProcessMemory 5348->5350 5349->5222 5351 193059 5350->5351 5352 192fe0 5350->5352 5351->5222 5352->5351 5353 193004 WriteProcessMemory 5352->5353 5353->5351 5354 193022 5353->5354 5354->5351 5355 193028 WriteProcessMemory 5354->5355 5355->5351 5356 19303c 5355->5356 5356->5351 5357 193044 WriteProcessMemory 5356->5357 5357->5351 5359 1947d1 5358->5359 5360 194875 5358->5360 5359->5360 5361 1947ed InterlockedIncrement 5359->5361 5360->5183 5365 194807 5361->5365 5362 19485c 5362->5183 5363 194560 8 API calls 5363->5365 5364 194470 _snprintf OpenFileMappingA MapViewOfFile CloseHandle 5364->5365 5365->5362 5365->5363 5365->5364 5366 195040 5367 19504c 5366->5367 5369 195060 5366->5369 5367->5369 5370 194e90 5367->5370 5371 195031 5370->5371 5376 194ea2 5370->5376 5371->5369 5373 194fa8 5378 196080 5373->5378 5375 193440 9 API calls 5375->5376 5376->5371 5376->5373 5376->5375 5377 192f90 4 API calls 5376->5377 5377->5376 5379 19608e 5378->5379 5381 195022 5378->5381 5380 193440 9 API calls 5379->5380 5379->5381 5380->5379 5381->5369

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 00194C20 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,00194E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 00194C32
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00194C3C
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00194C52
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00194C5C
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00194C66
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1673749002-0
                                                                                                                                                                                                              • Opcode ID: ff59e78a1284e40b5dd7b1f58a9d06669a7e4cd669f01cdf1cf14f8b419cdffc
                                                                                                                                                                                                              • Instruction ID: f32c1756e71c38f572c91317afbbe96b4e44ece482b2ea16d169991ff58e5937
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ff59e78a1284e40b5dd7b1f58a9d06669a7e4cd669f01cdf1cf14f8b419cdffc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3117079A00208BFDB10DBB4DD09FAE77B8EB4A751F004549FE09D6680EB719A448BA1
                                                                                                                                                                                                              Function 00194AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111synchronizationstringCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strncpy.MSVCRT(EDB88F28,00010000,00000104,EDB88320,00000000,00000D10,?,00000000), ref: 00194B1A
                                                                                                                                                                                                              • sprintf.MSVCRT(?,-%sMutex,00010000,EDB88F28,00010000,00000104,EDB88320,00000000,00000D10,?,00000000), ref: 00194B2C
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00194B3F
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s_0,00010000,?,?,?,?,?,?,?,?,?,00000000), ref: 00194B6F
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32(000F001F,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00194B85
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00194B97
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00194BE3
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00194C02
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
                                                                                                                                                                                                              • String ID: %s_0$-%sMutex
                                                                                                                                                                                                              • API String ID: 4144850300-892854768
                                                                                                                                                                                                              • Opcode ID: 0305d5268ba84a6b7a736cbc18d79ac84241ed4596ec5fc38b9119ad4055544e
                                                                                                                                                                                                              • Instruction ID: 2d7dcb1d35baf37dd438132bc5f99b11ef342bec260395d930139c5e551b3b11
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0305d5268ba84a6b7a736cbc18d79ac84241ed4596ec5fc38b9119ad4055544e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 813147B56002047BEB20DF64EC82FDBB3ACAF55714F044559FA59D7180EBB0D98586A0
                                                                                                                                                                                                              Function 00195A20 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 189threadCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 26 195a20-195a31 call 1935e0 29 195c49-195c4c 26->29 30 195a37-195a3e call 193a20 26->30 30->29 33 195a44-195a5b 30->33 34 195a61-195a68 33->34 35 195ae5-195b4a call 194d00 call 193080 * 2 33->35 34->35 36 195a6a-195a76 34->36 52 195b4f-195b63 35->52 36->35 38 195a78-195a7b call 193920 36->38 41 195a80-195a87 38->41 43 195a8d-195a97 41->43 44 195c46-195c48 41->44 46 195a99 43->46 47 195a9c-195aa0 43->47 44->29 46->47 49 195ad8-195ae3 47->49 50 195aa2-195aa5 47->50 49->35 49->38 53 195aaa-195aac 50->53 56 195b70-195b85 52->56 57 195b65-195b6c 52->57 54 195aae-195ab1 53->54 55 195ab3 53->55 58 195ab7-195ac2 call 193750 54->58 55->58 59 195bcc-195be5 56->59 60 195b87-195b8b 56->60 57->56 58->44 71 195ac8-195ad3 58->71 64 195bf4-195c0a CreateThread CloseHandle 59->64 65 195be7-195bf2 59->65 62 195b8d-195ba7 call 1939a0 60->62 63 195bc3-195bca 60->63 62->63 76 195ba9-195bbf 62->76 63->59 63->60 66 195c0c-195c1f 64->66 65->64 65->66 69 195c2e-195c44 CreateThread CloseHandle 66->69 70 195c21-195c2c 66->70 69->44 70->44 70->69 74 195ad5 71->74 75 195aa7 71->75 74->49 75->53 76->63
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_00005070,00000000,00000000,00000000), ref: 00195C03
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00195C0A
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_000050F0,00000000,00000000,00000000), ref: 00195C3D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00195C44
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleThread
                                                                                                                                                                                                              • String ID: LdrLoadDll$NtResumeThread$ntdll.dll
                                                                                                                                                                                                              • API String ID: 3032276028-1814628691
                                                                                                                                                                                                              • Opcode ID: 702fdf347d905258fb6e9440ce00f7d0ba07b2fa37af5b457dfef9c4e2438335
                                                                                                                                                                                                              • Instruction ID: 2c1fa9bb00c9876382b61ccc6a2d8384e421e0ea2ce3104ca613f080e437fbbb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 702fdf347d905258fb6e9440ce00f7d0ba07b2fa37af5b457dfef9c4e2438335
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D610575B40B02ABDF24DF69CC81F2673A6BF44704F194528E806EB681D7B0F941CB94
                                                                                                                                                                                                              Function 00194D00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: NtGetNextProcess$SeDebugPrivilege$ntdll.dll
                                                                                                                                                                                                              • API String ID: 0-503679825
                                                                                                                                                                                                              • Opcode ID: 5cda92e8054e6e13c568af970e7594aaec6d67e86af36677c9c3a27e4d0843c2
                                                                                                                                                                                                              • Instruction ID: c3b10f0a40b33f5dcec0dbb5e0c27bf4826555542e77c8e19f6cf38f49cc23b5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5cda92e8054e6e13c568af970e7594aaec6d67e86af36677c9c3a27e4d0843c2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0731F674A4421076DF20BBB5AC07F6E3654AB24B04F044455F459D76C1FBF5DA808BA5
                                                                                                                                                                                                              Function 00192F90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103injectionCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 132 192f90-192f9c 133 192fa2-192fa7 132->133 134 193074-19307b 132->134 133->134 135 192fad-192fb2 133->135 135->134 136 192fb8-192fbc 135->136 136->134 137 192fc2-192fda ReadProcessMemory 136->137 138 19306b-193073 137->138 139 192fe0-192ff6 call 192e40 137->139 139->138 142 192ff8-193020 call 192e20 WriteProcessMemory 139->142 142->138 145 193022-193026 142->145 145->138 146 193028-19303a WriteProcessMemory 145->146 146->138 147 19303c-193042 146->147 147->138 148 193044-193057 WriteProcessMemory 147->148 148->138 149 193059-19305d 148->149 149->138 150 19305f-19306a 149->150
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32(?,?,00000000,00000010,?), ref: 00192FD2
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(?,00000000,?,00000020,?), ref: 0019301C
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(?,?,?,00000000,00000020), ref: 00193036
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(?,00000000,00000000,00000004,00000020), ref: 00193053
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MemoryProcess$Write$Read
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2454571318-3916222277
                                                                                                                                                                                                              • Opcode ID: cad52e3a6cd9f864a704fc8363ae613913f074f23e1ca8289cd51e0db1a9fb67
                                                                                                                                                                                                              • Instruction ID: 819a62dc94e3b6567d925346249da6cf1f4811341fcd9d8e371a95fcdf5c7837
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cad52e3a6cd9f864a704fc8363ae613913f074f23e1ca8289cd51e0db1a9fb67
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1D316BB260050DAAEF11DE99DC80EEFB3BCEB40754F284269F90596144E731AF46DBA0
                                                                                                                                                                                                              Function 00194470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 151 194470-194488 152 19448e-1944e0 _snprintf OpenFileMappingA 151->152 153 194544-19455b 151->153 154 194530-194535 152->154 155 1944e2-194514 MapViewOfFile 152->155 156 194536-19453d 155->156 157 194516-194528 CloseHandle 155->157 156->153 157->154
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s_%d,EDB88F28,00000000), ref: 001944A7
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32(000F001F,00000000,?), ref: 001944BD
                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 001944F0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0019451B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseHandleMappingOpenView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 460513966-1933919280
                                                                                                                                                                                                              • Opcode ID: 7105b630ba14f9b367eccd8a0138376786f45eabee4ee09d8a6a136ae828286c
                                                                                                                                                                                                              • Instruction ID: 04499811d9a8286eade4591bcfc24d80097f4c19acb38e17cdd65f056661879c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7105b630ba14f9b367eccd8a0138376786f45eabee4ee09d8a6a136ae828286c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D21AEB62507069BE332CF58DD89B72B3E8EB84304F44857CA74687685DB79B8A0DB40

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 0019B480 Relevance: 66.9, APIs: 28, Strings: 10, Instructions: 363memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 0019B4A2
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF), ref: 00197401
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00197419
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 00197431
                                                                                                                                                                                                                • Part of subcall function 001973E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00197449
                                                                                                                                                                                                                • Part of subcall function 001973E0: _vsnprintf.MSVCRT(?,000001FE,001A0A8E,?), ref: 0019746B
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 0019747A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,001A1335), ref: 0019B51A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0019B536
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 0019B550
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,ERR), ref: 0019B5F5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0019B60D
                                                                                                                                                                                                              • strstr.MSVCRT(?,<br>), ref: 0019B641
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019B650
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004), ref: 0019B65F
                                                                                                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0019B67D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(-00000004,001A2BE4), ref: 0019B6A8
                                                                                                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0019B6C5
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000000), ref: 0019B719
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0019B74A
                                                                                                                                                                                                                • Part of subcall function 00191BA0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00191BC5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0019B75B
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0019B76E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0019B781
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,00000000), ref: 0019B796
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,00000000,?,00000104,00000000), ref: 0019B7AB
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,001A2C0C), ref: 0019B7CD
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000104,n%s[%s{%s%s{%s,?,?,00000000,?,00000000), ref: 0019B7FC
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,00000000,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000,00000000,00000104), ref: 0019B863
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,00000000,?,00000104,00000000,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0019B878
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,001A2C0C), ref: 0019B89A
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000104,n%s[%s{%s%s{%s,?,?,00000000,?,00000000), ref: 0019B8C9
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,[%s{%s%s{%s,?,00000000,?,00000000), ref: 0019B8E0
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0019B8F3
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$AllocHeap$lstrcpy$lstrlen$memset$InfoLocaleTime$??3@FileSystemVersion_vsnprintflstrcmpstrstr
                                                                                                                                                                                                              • String ID: 2K3$2K8$<br>$ERR$VIS$[%s{%s%s{%s$admin$http://api.wipmania.com/$isadmin$n%s[%s{%s%s{%s
                                                                                                                                                                                                              • API String ID: 124843797-3058427118
                                                                                                                                                                                                              • Opcode ID: f46f335147fd10f4955acd8f2c63a02a28a3cfdff43893c442595efbb913dfc1
                                                                                                                                                                                                              • Instruction ID: 650d054ae56a93cd88a35e5863466133c9fe942ec38fdaf28119e7c7b3e016cf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f46f335147fd10f4955acd8f2c63a02a28a3cfdff43893c442595efbb913dfc1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 09C1A1F5A48305BBEB24DFA4DDC2F6A73B8BB55704F00891DF246A7580D7B4E9448B60
                                                                                                                                                                                                              Function 00191EA0 Relevance: 37.7, APIs: 25, Instructions: 195fileencryptionCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00191ECD
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00191EDA
                                                                                                                                                                                                              • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00191EF5
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00191EFF
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00191F06
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$AcquireCloseContextCreateCryptFileHandle
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2213256293-0
                                                                                                                                                                                                              • Opcode ID: a5ab1fff0e48f8db55f168fc65bbf17fe45887fcb61926bc26c89569a2ba2742
                                                                                                                                                                                                              • Instruction ID: f9aef10772f51922c01f019ed65de31212f57854e5523546c7ee7a1d18cdbaa0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a5ab1fff0e48f8db55f168fc65bbf17fe45887fcb61926bc26c89569a2ba2742
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C8519FB6A00108BFDB109FF4EC88ABFB77CFB4A365F14459AFA05D2650D73189858B60
                                                                                                                                                                                                              Function 0019F130 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122filestringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000105), ref: 0019F150
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,00000105), ref: 0019F168
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,?), ref: 0019F17B
                                                                                                                                                                                                                • Part of subcall function 0019EDF0: memset.MSVCRT(?,00000000,00000103), ref: 0019EE0E
                                                                                                                                                                                                                • Part of subcall function 0019EDF0: vsprintf.MSVCRT(00000000,?,?,?,00000000,00000103), ref: 0019EE22
                                                                                                                                                                                                                • Part of subcall function 0019EDF0: PathAppendA.SHLWAPI(?,00000000), ref: 0019EE35
                                                                                                                                                                                                              • SetCurrentDirectoryA.KERNEL32(?), ref: 0019F196
                                                                                                                                                                                                              • FindFirstFileA.KERNEL32(?,?), ref: 0019F1AA
                                                                                                                                                                                                              • CoInitialize.OLE32(00000000), ref: 0019F1C2
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,%s%s,?,?), ref: 0019F1E1
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 0019F20C
                                                                                                                                                                                                              • strncmp.MSVCRT(?,RECYCLED,00000008), ref: 0019F22E
                                                                                                                                                                                                              • strstr.MSVCRT(?,.inf), ref: 0019F246
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,%s%s,?,?), ref: 0019F26B
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 0019F290
                                                                                                                                                                                                              • FindClose.KERNEL32(?), ref: 0019F29E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Find$Filememset$Next_snprintf$AppendCloseCurrentDirectoryFirstInitializePathlstrcpystrncmpstrstrvsprintf
                                                                                                                                                                                                              • String ID: %s%s$.inf$RECYCLED
                                                                                                                                                                                                              • API String ID: 3870971729-188919753
                                                                                                                                                                                                              • Opcode ID: 1a9914b24e724c679eead85f35c53764ecadc7a22c74087ec17a6fed19e6a691
                                                                                                                                                                                                              • Instruction ID: c75db327c554202172d07d2bb3d22e458a63b4036696a4cca787a8173bbeb4a1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a9914b24e724c679eead85f35c53764ecadc7a22c74087ec17a6fed19e6a691
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96416DBA94021CBBCB10DBA4DC85FEB737CEB59745F044599F908A2141E770AFC98BA0
                                                                                                                                                                                                              Function 001953D0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 258injectionmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcess.KERNEL32(0000047A,00000000,?), ref: 0019540E
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 001956C0
                                                                                                                                                                                                                • Part of subcall function 00194900: WaitForSingleObject.KERNEL32(00197495,000000FF,?,00000000,756F59EB,?,00197495), ref: 00194939
                                                                                                                                                                                                                • Part of subcall function 00194900: ReleaseMutex.KERNEL32(?,?,00197495), ref: 0019497C
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 001954AB
                                                                                                                                                                                                              • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0019552F
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(00000000,00000000,?,?,?), ref: 0019554E
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32(00000000,?,?,00000004,?), ref: 001955A0
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32(00000000,?,?,00000004,?), ref: 001955C4
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32(00000000,?,?,00000004,?), ref: 001955EC
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32(00000000,?,001C89B0,00000005,?), ref: 00195618
                                                                                                                                                                                                                • Part of subcall function 00194160: VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 00194192
                                                                                                                                                                                                                • Part of subcall function 00194160: WriteProcessMemory.KERNEL32(?,00000000,00000000,?,?), ref: 0019424F
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(00000000,?,?,00000005,?), ref: 001956B7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$Memory$Read$Write$AllocVirtual$CloseCompareExchangeHandleInterlockedMutexObjectOpenReleaseSingleWait
                                                                                                                                                                                                              • String ID: STFU
                                                                                                                                                                                                              • API String ID: 2493432397-778810564
                                                                                                                                                                                                              • Opcode ID: ea0aecdda560ca31bfa6a8a826673679b4a7641588b1cdf3c388087dc29de17a
                                                                                                                                                                                                              • Instruction ID: 1e1de3dedcdcc33cbe7cabe24d06c65628925233b34697f42a8f6a69fd962dd2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ea0aecdda560ca31bfa6a8a826673679b4a7641588b1cdf3c388087dc29de17a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA9160B5A01609AFEF11DFA4CC81FEE77B9EB84704F544159E605AB280E770AA41CFA4
                                                                                                                                                                                                              Function 00199D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129memoryfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000004), ref: 00199DA7
                                                                                                                                                                                                              • CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,20000080,00000000), ref: 00199DD5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocCreateFileVirtual
                                                                                                                                                                                                              • String ID: \\.\PHYSICALDRIVE0
                                                                                                                                                                                                              • API String ID: 1475775534-1557481562
                                                                                                                                                                                                              • Opcode ID: 03de6d0eaac765eae5667b59f216c1b2e2647c930ddcb38d140bde61a22c9c85
                                                                                                                                                                                                              • Instruction ID: acfbc67318a81c77bc46a4fc448609a2e9fdabc7c619f218832e47f3380ae027
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 03de6d0eaac765eae5667b59f216c1b2e2647c930ddcb38d140bde61a22c9c85
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3631F9767803047AF62096BDAD47FEB775DD785B72F200266FB08EA1C0DAA06D4086F4
                                                                                                                                                                                                              Function 00199EC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF), ref: 00199EDF
                                                                                                                                                                                                              • CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00199F16
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,00090018,00000000,00000000,00000000,00000000,?,00000000), ref: 00199F45
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 00199F5A
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 00199F74
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00199F77
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ControlDeviceFile$CloseCreateHandleWritememset
                                                                                                                                                                                                              • String ID: 00100$U$\\.\PHYSICALDRIVE0
                                                                                                                                                                                                              • API String ID: 3939175881-3482488017
                                                                                                                                                                                                              • Opcode ID: 8a04556ddf3a8521873a132321d8faf91a95f330b8cafce9d1f6c03f78f472f2
                                                                                                                                                                                                              • Instruction ID: 82aa852e24f1b67bdbfb43ba15445989456d908f6b9dc7662cc1b452221628fe
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8a04556ddf3a8521873a132321d8faf91a95f330b8cafce9d1f6c03f78f472f2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57119435BD03187AF730E6A89C0BFDAB66C8B56F11F100284F714BA1C19BF0274587A9
                                                                                                                                                                                                              Function 0019A550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,NtShutdownSystem), ref: 0019A57A
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0019A58F
                                                                                                                                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0019A5B3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019A5B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Token$AdjustErrorLastLookupOpenPrivilegePrivilegesProcessValue
                                                                                                                                                                                                              • String ID: NtShutdownSystem$SeShutdownPrivilege$ntdll.dll
                                                                                                                                                                                                              • API String ID: 137217592-1699316426
                                                                                                                                                                                                              • Opcode ID: 39a467d07982bfa7283c4d69bba46397a42694970ca93ed648fc6f53a33fb66e
                                                                                                                                                                                                              • Instruction ID: 68fa306a8d4e8cedd01fa21b7b5db8e7e3d7775f9410dcc0a36c0856ed1d6b99
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39a467d07982bfa7283c4d69bba46397a42694970ca93ed648fc6f53a33fb66e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8F04F79B40314BBEB10EBE49D0AFEE76BC9B05B05F100154F614E65D1DBF06A448BA2
                                                                                                                                                                                                              Function 001942E0 Relevance: 10.6, APIs: 7, Instructions: 131COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: a45a8eb00313111c7edd7a989c62ad242edf1e69f64391c77031620be21e5d67
                                                                                                                                                                                                              • Instruction ID: b30df2b640b72ff498beacf83ae76133947d0052379d72508f65850770dbd26b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a45a8eb00313111c7edd7a989c62ad242edf1e69f64391c77031620be21e5d67
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A931D071700214ABEB209F7AEC41F6BB3ACFB84721F144569FD09D7680DB31ED0186A0
                                                                                                                                                                                                              Function 0019D7A0 Relevance: 145.7, APIs: 54, Strings: 29, Instructions: 473memorystringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 608 19d7a0-19d802 HeapAlloc * 2 memset 609 19d82b-19d82d 608->609 610 19d804-19d806 608->610 613 19d82f-19d837 GetLastError 609->613 614 19d84e-19d850 609->614 611 19d808-19d80b HeapFree 610->611 612 19d811-19d813 610->612 611->612 617 19d81f-19d828 612->617 618 19d815-19d819 HeapFree 612->618 619 19d839-19d83c HeapFree 613->619 620 19d842-19d84b 613->620 615 19d86d-19d882 ReadFile 614->615 616 19d852-19d86a GetLastError HeapFree 614->616 621 19d888 615->621 622 19dcc1-19dcca GetLastError 615->622 618->617 619->620 623 19d890-19d895 621->623 624 19dccc GetLastError 622->624 625 19dcd2-19dcf0 FlushFileBuffers DisconnectNamedPipe CloseHandle 622->625 623->622 626 19d89b-19d8a6 623->626 624->625 627 19dcfb-19dd18 HeapFree * 2 625->627 628 19d8a8-19d8b0 626->628 629 19d8cc-19d8df atoi 626->629 630 19d8b2-19d8b7 628->630 631 19dcf5-19dcf8 629->631 632 19d8e5-19d8f4 strchr 629->632 633 19d8b9-19d8c0 630->633 634 19d8c4 630->634 631->627 635 19d8fa-19d936 lstrlenA call 191440 HeapAlloc * 2 632->635 636 19dcf2 632->636 633->630 637 19d8c2 633->637 634->629 640 19d93c-19d94b strchr 635->640 641 19dc72-19dc77 635->641 636->631 637->629 640->641 642 19d951-19d983 lstrlenA lstrcpynA * 2 lstrcmpA 640->642 643 19dc79-19dc80 HeapFree 641->643 644 19dc86-19dc88 641->644 645 19d9e8-19d9f2 lstrcmpA 642->645 646 19d985-19d9b9 call 19ba00 lstrlenA HeapAlloc 642->646 643->644 647 19dc8a-19dc91 HeapFree 644->647 648 19dc97-19dcbb ReadFile 644->648 650 19da58-19da62 lstrcmpA 645->650 651 19d9f4-19da29 call 19ba00 lstrlenA HeapAlloc 645->651 657 19d9bb-19d9da lstrcpyA lstrcatA call 1931a0 646->657 658 19d9dd-19d9e3 646->658 647->648 648->622 648->623 652 19da83-19da8d lstrcmpA 650->652 653 19da64-19da7e call 19ba00 650->653 667 19da2b-19da4a lstrcpyA lstrcatA call 1931a0 651->667 668 19da4d-19da53 651->668 659 19da8f-19daa9 call 19ba00 652->659 660 19daae-19dab8 lstrcmpA 652->660 653->641 657->658 658->641 659->641 665 19daba-19daec call 19ba00 lstrlenA HeapAlloc 660->665 666 19db0f-19db19 lstrcmpA 660->666 685 19daee-19db01 lstrcpyA call 1931a0 665->685 686 19db04-19db0a 665->686 669 19db1b-19db25 lstrcmpA 666->669 670 19db50-19db5a lstrcmpA 666->670 667->668 668->641 675 19db31-19db4b call 19ba00 669->675 676 19db27-19db2c 669->676 677 19db7a-19db84 lstrcmpA 670->677 678 19db5c-19db75 call 19ba00 670->678 675->641 676->641 683 19dba5-19dbaf lstrcmpA 677->683 684 19db86-19dba0 call 19ba00 677->684 678->641 691 19dbb1-19dbcb call 19ba00 683->691 692 19dbd0-19dbda lstrcmpA 683->692 684->641 685->686 686->641 691->641 694 19dbdc-19dbf5 call 19ba00 692->694 695 19dbf7-19dc01 lstrcmpA 692->695 694->641 700 19dc03-19dc23 call 19ba00 695->700 701 19dc25-19dc2f lstrcmpA 695->701 700->641 704 19dc31-19dc44 call 197330 701->704 705 19dc46-19dc50 lstrcmpA 701->705 704->641 705->641 708 19dc52-19dc6c call 19ba00 705->708 708->641
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000800), ref: 0019D7C3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000800), ref: 0019D7D2
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019D7EE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,?,00000000), ref: 0019D80B
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019D819
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019D82F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019D83C
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019D852
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019D85B
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,00000000,00000800,00000000,00000000), ref: 0019D87A
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 0019D8D3
                                                                                                                                                                                                              • strchr.MSVCRT(00000000,0000002E), ref: 0019D8E8
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0019D900
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0019D924
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0019D930
                                                                                                                                                                                                              • strchr.MSVCRT(00000000,0000002E), ref: 0019D93F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019D952
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000001,00000000), ref: 0019D95E
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,00000000,00000001), ref: 0019D96D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,ftplog), ref: 0019D97F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFree$ErrorLastlstrcpynlstrlenstrchr$FileReadatoilstrcmpmemset
                                                                                                                                                                                                              • String ID: 30e44aa1$FTP -> $POP3 -> $[DNS]: Blocked DNS "%s"$[FTP Infect]: %s was iframed$[FTP Login]: %s$[HTTP Login]: %s$[HTTP Traffic]: %s$[HTTP]: %s$[MSN]: %s$[PDef+]: %s$[POP3 Login]: %s$[Ruskill]: Detected DNS: "%s"$[Ruskill]: Detected File: "%s"$[Ruskill]: Detected Reg: "%s"$blk$block$disable$dns$ftpinfect$ftplog$httplogin$httpspread$httptraff$msn$poplog$rdns$rreg$ruskill
                                                                                                                                                                                                              • API String ID: 1531277263-3670165947
                                                                                                                                                                                                              • Opcode ID: 83ae256d98d966040fec62a55baa511f79d6edefb2e137da7c1cc8b7922bb71f
                                                                                                                                                                                                              • Instruction ID: d25368156fcf205ad1fa05a100deae6ea736b5c1f6f766ce4adae0a46beea476
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 83ae256d98d966040fec62a55baa511f79d6edefb2e137da7c1cc8b7922bb71f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47E11779640604BBDF209BB4AC8AFBF766CEF97B41F554008FA05A2681DBB09D41C7B1
                                                                                                                                                                                                              Function 001A0430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 712 1a0430-1a049e lstrlenA GetProcessHeap HeapAlloc memset GetProcessHeap 713 1a07c2-1a07ca 712->713 714 1a04a4-1a04b8 lstrcpyA 712->714 715 1a04be-1a04d0 sscanf 714->715 716 1a0695-1a06ab sscanf 714->716 717 1a0792-1a07a6 HeapFree 715->717 718 1a04d6-1a04e6 strstr 715->718 716->717 719 1a06b1-1a06c3 strstr 716->719 723 1a07a8-1a07ac HeapFree 717->723 724 1a07ae-1a07b0 717->724 718->717 720 1a04ec-1a050f lstrlenA * 2 HeapAlloc 718->720 721 1a06c9-1a06df strstr 719->721 722 1a078f 719->722 720->717 725 1a0515-1a0528 strtok 720->725 721->722 726 1a06e5-1a070a lstrlenA * 2 HeapAlloc 721->726 722->717 723->724 727 1a07b8-1a07c1 724->727 728 1a07b2-1a07b6 HeapFree 724->728 725->717 729 1a052e-1a053a lstrcpyA 725->729 726->722 730 1a0710-1a0756 lstrlenA * 2 lstrcpynA lstrlenA * 2 HeapAlloc 726->730 728->727 731 1a0540-1a0549 729->731 730->722 732 1a0758-1a078c lstrlenA * 2 _snprintf 730->732 733 1a05fb-1a060f strtok 731->733 734 1a054f-1a0561 _memicmp 731->734 732->722 733->731 735 1a0615 733->735 736 1a058b-1a05a0 _memicmp 734->736 737 1a0563-1a0589 lstrlenA _snprintf 734->737 738 1a062d-1a0672 lstrlenA _snprintf lstrlenA * 2 HeapAlloc 735->738 740 1a05a2-1a05ae lstrcatA 736->740 741 1a05b0-1a05c5 _memicmp 736->741 739 1a05ef-1a05f3 lstrcatA 737->739 738->722 742 1a0678-1a0690 _snprintf 738->742 743 1a05f8-1a05f9 lstrcatA 739->743 740->743 744 1a05c7-1a05d3 lstrcatA 741->744 745 1a05d5-1a05ea _memicmp 741->745 742->722 743->733 744->743 746 1a05ec 745->746 747 1a0617-1a062b lstrcatA * 3 745->747 746->739 747->738
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 001A0446
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000001), ref: 001A044C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 001A0453
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 001A048B
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 001A0493
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 001A04A9
                                                                                                                                                                                                              • sscanf.MSVCRT(00000000,SDG %d,?), ref: 001A04C5
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,X-MMS-IM-Format: ), ref: 001A04DC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00192780), ref: 001A04F0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 001A04FA
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 001A0505
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 001A051B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,001A1335), ref: 001A0534
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,Content-Length: ,00000010), ref: 001A0557
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00192780), ref: 001A0567
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,Content-Length: %d,00000000), ref: 001A057B
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,From: ,00000006), ref: 001A0596
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 001A05A7
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 001A05F1
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A2B84), ref: 001A05F9
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 001A0602
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 001A061C
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 001A0624
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00192780), ref: 001A062B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A062E
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,SDG %d %d,?,00000000), ref: 001A0646
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A064F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 001A065A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000040), ref: 001A0667
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,0000003F,%s%s,?,00000000), ref: 001A0688
                                                                                                                                                                                                              • sscanf.MSVCRT(00000000,MSG %d %1s,?,?), ref: 001A06A0
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A2B84), ref: 001A06B7
                                                                                                                                                                                                              • strstr.MSVCRT(-00000002,), ref: 001A06D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A06E6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 001A06F3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 001A06FF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A0714
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 001A0721
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,-00000002,?), ref: 001A072C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 001A0736
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00192780), ref: 001A073E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 001A074B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00192780), ref: 001A0761
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00192780), ref: 001A076A
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,?,MSG %d %s %d%s%s,?,?,00000004), ref: 001A0787
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A079F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 001A07AC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A07B6
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
                                                                                                                                                                                                              • API String ID: 375969099-2909086048
                                                                                                                                                                                                              • Opcode ID: 38d6be5285677dd8239f0b3bf9a7d83114fbcf2ac56bb146f9179c59352fe385
                                                                                                                                                                                                              • Instruction ID: b4ea87f4163c09058427b635372aafd26989c5832ec54a0ae096acaac7c2010b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 38d6be5285677dd8239f0b3bf9a7d83114fbcf2ac56bb146f9179c59352fe385
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 90A13BB9E00209BBDB11DBB48C86EBF77BCEF5A740F144559F904A6241EB74EE448B60
                                                                                                                                                                                                              Function 0019F430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431filestringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 748 19f430-19f62e call 1a0f10 memset * 11 sprintf * 2 wsprintfW sprintf * 3 wsprintfW * 2 call 191cf0 753 19f630-19f643 call 191ea0 748->753 754 19f672-19f6b2 SetFileAttributesA * 3 CreateDirectoryA 748->754 753->754 762 19f645-19f655 _stricmp 753->762 755 19f6c1-19f6d6 CopyFileW 754->755 756 19f6b4-19f6bf GetLastError 754->756 758 19f669-19f671 755->758 759 19f6d8-19f706 lstrlenA call 191c50 call 197700 755->759 756->755 756->758 767 19f70c-19f733 call 1935f0 759->767 768 19f8c2-19f8d0 Sleep 759->768 762->754 764 19f657-19f667 _stricmp 762->764 764->754 764->758 777 19f740-19f747 CreateFileW 767->777 778 19f735-19f73e 767->778 770 19f8d2-19f8d8 768->770 771 19f8e5-19f8eb 768->771 773 19f8f8-19f900 770->773 774 19f8da-19f8e3 770->774 775 19f8ed-19f8f6 771->775 776 19f903-19f909 771->776 779 19f901 SetFileAttributesA 773->779 774->779 775->779 780 19f90b-19f911 776->780 781 19f91e-19f924 776->781 786 19f74d-19f751 777->786 778->786 779->776 782 19f931-19f939 780->782 783 19f913-19f91c 780->783 784 19f93c-19f962 call 19f130 781->784 785 19f926-19f92f 781->785 787 19f93a SetFileAttributesA 782->787 783->787 795 19f993-19f9a3 call 197700 784->795 796 19f964-19f98d CreateFileA GetFileSize LockFile 784->796 785->787 786->758 790 19f757-19f78e 786->790 787->784 791 19f792-19f79f 790->791 793 19f7bb-19f7d0 791->793 794 19f7a1-19f7b9 call 193870 791->794 798 19f821-19f82e lstrlenA 793->798 799 19f7d2-19f81f lstrcpyA lstrcatA * 2 lstrlenA 793->799 794->793 805 19f9a5-19f9ce CreateFileA GetFileSize LockFile 795->805 806 19f9d4-19f9df 795->806 796->795 802 19f834-19f84f WriteFile call 193870 798->802 799->802 808 19f851-19f855 802->808 809 19f856-19f85b 802->809 805->806 808->809 810 19f85d 809->810 811 19f8a6-19f8aa 809->811 814 19f860-19f898 call 19f3b0 lstrlenA WriteFile call 193870 810->814 812 19f790 811->812 813 19f8b0-19f8c0 CloseHandle 811->813 812->791 813->768 819 19f89a-19f89e 814->819 820 19f89f-19f8a4 814->820 819->820 820->811 820->814
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0019F459
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019F472
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 0019F48B
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 0019F4A4
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 0019F4BD
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,000003FF,?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 0019F4D6
                                                                                                                                                                                                              • memset.MSVCRT ref: 0019F4F2
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019F50B
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,0000040E,?,00000000,00000103), ref: 0019F526
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 0019F541
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206,?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 0019F55C
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%sautorun.inf,?,?,00000000,00000206,?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 0019F571
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%sautorun.tmp,?), ref: 0019F586
                                                                                                                                                                                                              • wsprintfW.USER32(?,001A3018,?,?,%sautorun.tmp,?), ref: 0019F5A4
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s\%s,001DBDB0,001DBEB4), ref: 0019F5BC
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s%s,?,001DBDB0,?,%s\%s,001DBDB0,001DBEB4), ref: 0019F5D3
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s%s,?,?,?,%s%s,?,001DBDB0,?,%s\%s,001DBDB0,001DBEB4), ref: 0019F5EC
                                                                                                                                                                                                              • wsprintfW.USER32(?,001A3018,?), ref: 0019F607
                                                                                                                                                                                                              • wsprintfW.USER32(?,%S%S\Desktop.ini,?,001DBDB0), ref: 0019F61B
                                                                                                                                                                                                                • Part of subcall function 00191CF0: GetFileAttributesW.KERNEL32(?), ref: 00191CF7
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,ERR), ref: 0019F64B
                                                                                                                                                                                                              • _stricmp.MSVCRT(001DA920,00000000), ref: 0019F65D
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0019F684
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0019F692
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0019F6A0
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 0019F6AA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019F6B4
                                                                                                                                                                                                              • CopyFileW.KERNEL32(001DB9A0,?,00000000), ref: 0019F6CE
                                                                                                                                                                                                              • lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 0019F6DE
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0019F747
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00001A2F), ref: 0019F7DA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,?), ref: 0019F7EE
                                                                                                                                                                                                                • Part of subcall function 00191EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00191ECD
                                                                                                                                                                                                                • Part of subcall function 00191EA0: GetLastError.KERNEL32 ref: 00191EDA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,001A2B84), ref: 0019F800
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 0019F813
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00001A2F,?,00000000), ref: 0019F828
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00001A2F,00000000), ref: 0019F837
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 0019F87C
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000), ref: 0019F88B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019F8B1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 0019F8C4
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 0019F901
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 0019F93A
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0019F97D
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0019F984
                                                                                                                                                                                                              • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0019F98D
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0019F9BE
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0019F9C5
                                                                                                                                                                                                              • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0019F9CE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
                                                                                                                                                                                                              • String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
                                                                                                                                                                                                              • API String ID: 2867265384-3663527224
                                                                                                                                                                                                              • Opcode ID: e9d3fa662003a78bbc7c907847b7c396dc28acf6519f4baaecde85779468f34a
                                                                                                                                                                                                              • Instruction ID: 027047b3f05b1b5da4987b2dcb7b928f4a689ce5d0fe7f696547114f380644e4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e9d3fa662003a78bbc7c907847b7c396dc28acf6519f4baaecde85779468f34a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 02E1A3B5941218BADB21DB60CC85FEB777CEB5AB04F004599F609E2081D7B0ABC5CBA5
                                                                                                                                                                                                              Function 0019E9F0 Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 271stringfilethreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019EA0F
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(ws2_32.dll), ref: 0019EA22
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(secur32.dll), ref: 0019EA29
                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(wininet.dll), ref: 0019EA30
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,001A57AC), ref: 0019EA3B
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0019EA44
                                                                                                                                                                                                                • Part of subcall function 00197330: memset.MSVCRT(?,00000000,000001FF), ref: 00197351
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(?), ref: 00197369
                                                                                                                                                                                                                • Part of subcall function 00197330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00197381
                                                                                                                                                                                                                • Part of subcall function 00197330: _vsnprintf.MSVCRT(00000000,000001FE,001A0AAD,?), ref: 001973A3
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(00000000), ref: 001973B2
                                                                                                                                                                                                              • CopyFileW.KERNEL32(001DAFB0,001DADA0,00000000), ref: 0019EACF
                                                                                                                                                                                                                • Part of subcall function 0019D6B0: RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0019D731
                                                                                                                                                                                                                • Part of subcall function 0019D6B0: RegCloseKey.ADVAPI32(?), ref: 0019D740
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0019EAFC
                                                                                                                                                                                                                • Part of subcall function 00191AD0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00191AE9
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(001DAFB0), ref: 0019EB2F
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0019EB3A
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(001DAFB0), ref: 0019EB41
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DA920,ERR), ref: 0019EB61
                                                                                                                                                                                                              • lstrlenA.KERNEL32(001A57C0), ref: 0019EB72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(001A57C0), ref: 0019EBB5
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000103,001A2B10,00000539), ref: 0019EBDE
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019EC15
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(001DB3C8), ref: 0019EC32
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206,001DA6E0,001C7A80,00000001), ref: 0019EC5F
                                                                                                                                                                                                              • wsprintfW.USER32(?,%s:Zone.Identifier,001DADA0,?,00000000,00000206,001DA6E0,001C7A80,00000001), ref: 0019EC75
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(?), ref: 0019EC95
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019EC97
                                                                                                                                                                                                                • Part of subcall function 00191CF0: GetFileAttributesW.KERNEL32(?), ref: 00191CF7
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E880,00000000,00000000,00000000), ref: 0019ECB2
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019ECBB
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0019E990,00000000,00000000,00000000), ref: 0019ECCC
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019ECCF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(001DB3E0), ref: 0019ED26
                                                                                                                                                                                                              • lstrlenA.KERNEL32(001DAC50,?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000), ref: 0019ED5E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E770,001DB990,00000000,00000000,?,001DAC50,00000000), ref: 0019ED83
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019ED86
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0019FC90,00000000,00000000,00000000), ref: 0019EDA1
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019EDA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$File$CloseCreate$HandleThread$DeleteLibraryLoadmemset$SleepTime_snprintf$AttributesCopyCriticalErrorInitializeLastMutexObjectSectionSingleSystemValueWait_vsnprintflstrcpywsprintf
                                                                                                                                                                                                              • String ID: %s:Zone.Identifier$ERR$IPC_Check$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$msnint$msnmsg$ngrBot$running$secur32.dll$wininet.dll$ws2_32.dll
                                                                                                                                                                                                              • API String ID: 4164503275-3436408089
                                                                                                                                                                                                              • Opcode ID: 3692b6d9d23d41eba2ab8d31331659502f105d655b7b3ff94c3c3928f0e48485
                                                                                                                                                                                                              • Instruction ID: 9c238389c0c448a1840fe66027bffb55aeadcb10b21a07f198a5ece1c1799a3b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3692b6d9d23d41eba2ab8d31331659502f105d655b7b3ff94c3c3928f0e48485
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3881EAB5BC131476EE20F7A49C47F5B36989F61F45F544012FB05B62C2DBF0AA8086AB
                                                                                                                                                                                                              Function 0019E130 Relevance: 59.8, APIs: 24, Strings: 10, Instructions: 255sleepstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(001DB3C8), ref: 0019E14B
                                                                                                                                                                                                                • Part of subcall function 00199FF0: strtok.MSVCRT(?,?,0000002C), ref: 0019A013
                                                                                                                                                                                                                • Part of subcall function 00199FF0: strtok.MSVCRT(00000000,?), ref: 0019A04F
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019E17E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019E18B
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019E198
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019E1A5
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0019E1C8
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0019E22B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019E24D
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,00000000,00000000), ref: 0019E259
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(00000000,001DADA0,0000000B), ref: 0019E292
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(00000000,001DADA0,00000004), ref: 0019E2A4
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DA920,00000000), ref: 0019E2C0
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,001A2C7C), ref: 0019E2D3
                                                                                                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 0019E2FA
                                                                                                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 0019E30A
                                                                                                                                                                                                                • Part of subcall function 0019BA00: memset.MSVCRT(?,00000000,000007FF), ref: 0019BA1E
                                                                                                                                                                                                                • Part of subcall function 0019BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0019BA42
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(00000000), ref: 0019E43A
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019E45D
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0019E46B
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DB3C8), ref: 0019E478
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d, xrefs: 0019E41C
                                                                                                                                                                                                              • [d="%s"] Error downloading file [e="%d"], xrefs: 0019E405
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s), xrefs: 0019E359
                                                                                                                                                                                                              • QUIT :%s, xrefs: 0019E2E3
                                                                                                                                                                                                              • rebooting, xrefs: 0019E2DE
                                                                                                                                                                                                              • [d='%s"] Error getting application data path [e="%d"], xrefs: 0019E3F4
                                                                                                                                                                                                              • [d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0019E3D1
                                                                                                                                                                                                              • [d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0019E383, 0019E3AE
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0019E36E
                                                                                                                                                                                                              • bsod, xrefs: 0019E312
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLastSleep$File$CriticalMoveSectionstrtok$??3@DeleteEnterFreeHeapLeave_memicmplstrcmplstrcpylstrlenmemsetwvsprintf
                                                                                                                                                                                                              • String ID: QUIT :%s$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$bsod$rebooting
                                                                                                                                                                                                              • API String ID: 4206007775-4213298338
                                                                                                                                                                                                              • Opcode ID: c38a59d5e4a4b08e223d22df47acb7f048f17a654227cc568273d2d612eff070
                                                                                                                                                                                                              • Instruction ID: 849ebffcd4ad2a3063b9836feb95ed1ca1e203145f9bf26300781ec7ce4f7755
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c38a59d5e4a4b08e223d22df47acb7f048f17a654227cc568273d2d612eff070
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8481C0B4A40304FBDF20DBA4DC4AE7F77B8EF56B00F544519F952D2691E7709A408B62
                                                                                                                                                                                                              Function 0019DDB0 Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 281sleepstringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(001DB3C8), ref: 0019DDCF
                                                                                                                                                                                                                • Part of subcall function 00199FF0: strtok.MSVCRT(?,?,0000002C), ref: 0019A013
                                                                                                                                                                                                                • Part of subcall function 00199FF0: strtok.MSVCRT(00000000,?), ref: 0019A04F
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,http://), ref: 0019DDF4
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019DE11
                                                                                                                                                                                                              • toupper.MSVCRT(00000000), ref: 0019DE28
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019DE68
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019DE71
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019DE7A
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019DE83
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0019DEA8
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0019DF16
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,00000000), ref: 0019DF3D
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 0019DF6A
                                                                                                                                                                                                              • GetLastError.KERNEL32([d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"],?,?,?,00000000), ref: 0019E021
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019E059
                                                                                                                                                                                                              • GetLastError.KERNEL32([d="%s" s="%d bytes"] Error creating process "%S" [e="%d"],?,?,?,00000000), ref: 0019E037
                                                                                                                                                                                                                • Part of subcall function 0019BA00: memset.MSVCRT(?,00000000,000007FF), ref: 0019BA1E
                                                                                                                                                                                                                • Part of subcall function 0019BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0019BA42
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019E0DD
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0019E0EB
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DB3C8), ref: 0019E0F8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [d="%s"] Error downloading file [e="%d"], xrefs: 0019E08E
                                                                                                                                                                                                              • exe, xrefs: 0019DEE4
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d, xrefs: 0019E0A5
                                                                                                                                                                                                              • [d='%s"] Error getting application data path [e="%d"], xrefs: 0019E080
                                                                                                                                                                                                              • [d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0019E060
                                                                                                                                                                                                              • [d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0019E042
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0019E017
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Error creating process "%S" [e="%d"], xrefs: 0019E030
                                                                                                                                                                                                              • http://, xrefs: 0019DDEE
                                                                                                                                                                                                              • [d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s), xrefs: 0019DFFE
                                                                                                                                                                                                              • dlds, xrefs: 0019DE44, 0019DFA6
                                                                                                                                                                                                              • ERR, xrefs: 0019DFEC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$Sleep$CriticalSectionstrtok$??3@EnterFreeHeapLeave_stricmplstrlenmemsetstrstrtoupperwvsprintf
                                                                                                                                                                                                              • String ID: ERR$[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]$[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$dlds$exe$http://
                                                                                                                                                                                                              • API String ID: 3190375853-4059846736
                                                                                                                                                                                                              • Opcode ID: 0d57eb87a68483f224463a45a6e9113fbdf94b955daf73004e5b84965cc2a416
                                                                                                                                                                                                              • Instruction ID: 1e7127c3ab1f5921b99568167d1ae75b22706497bab8ca5c8e65c1534711d24a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0d57eb87a68483f224463a45a6e9113fbdf94b955daf73004e5b84965cc2a416
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5091B2B9A00204BFDF14DBA8EC86A7FB7B8AF95700F554119F906A7281E770AE41C761
                                                                                                                                                                                                              Function 00197870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF,?,00000000,?), ref: 00197898
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 0019795D
                                                                                                                                                                                                              • _snprintf.MSVCRT(001DA2B0,000001FF,001A13EC,-00000005,?,?,00000000,?), ref: 0019797B
                                                                                                                                                                                                              • _snprintf.MSVCRT(001DA4B0,000001FF,001A13EC,-00000005,?,?,00000000,?), ref: 001979B7
                                                                                                                                                                                                              • lstrlenA.KERNEL32(001DA2B0,?,00000000,?), ref: 00197A5A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(001DA4B0), ref: 00197A69
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,ftp://%s:%s@%s:%d,001DA2B0,001DA4B0,00000000,00000000), ref: 00197AD9
                                                                                                                                                                                                              • _stricmp.MSVCRT(001DA2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,001DA2B0,001DA4B0,00000000,00000000), ref: 00197AE8
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,pop3://%s:%s@%s:%d,001DA2B0,001DA4B0,00000000,00000000), ref: 00197B66
                                                                                                                                                                                                                • Part of subcall function 00192460: GetProcessHeap.KERNEL32(?,001920DE,?), ref: 0019246C
                                                                                                                                                                                                                • Part of subcall function 00192460: HeapAlloc.KERNEL32(?,00000008,001920DE,?,001920DE,?), ref: 0019247E
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DA2B0,001A1335,?,00000000,?), ref: 00197BBC
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DA4B0,001A1335), ref: 00197BC8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
                                                                                                                                                                                                              • String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
                                                                                                                                                                                                              • API String ID: 389836911-2374598668
                                                                                                                                                                                                              • Opcode ID: 8cb06b6a156fafd05255607532660dc0072cd10fdc5431447889a77fff7fd66c
                                                                                                                                                                                                              • Instruction ID: 309f33f0802afb975f2c32b1772824b3c0425e076c66cef89cb77f684693f179
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8cb06b6a156fafd05255607532660dc0072cd10fdc5431447889a77fff7fd66c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C813874E5E355BADF34EF688C4AF6E3BA4AF22714F4C4456E409A32C2D7B0D9808653
                                                                                                                                                                                                              Function 001A0910 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 172sleepstringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 001A0930
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 001A093D
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 001A095D
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 001A0982
                                                                                                                                                                                                              • ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000,00000005,00000003), ref: 001A09BF
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF), ref: 00197401
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00197419
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 00197431
                                                                                                                                                                                                                • Part of subcall function 001973E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00197449
                                                                                                                                                                                                                • Part of subcall function 001973E0: _vsnprintf.MSVCRT(?,000001FE,001A0A8E,?), ref: 0019746B
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 0019747A
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 001A09CF
                                                                                                                                                                                                              • Sleep.KERNEL32 ref: 001A0A05
                                                                                                                                                                                                              • OpenMutexA.KERNEL32(001F0001,00000000,001A57AC), ref: 001A0A17
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 001A0A27
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 001A0A2E
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 001A0A32
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 001A0A3D
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000103,%08x,00000000,30e44aa1,00000000), ref: 001A0A60
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 001A0A79
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 001A0A98
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,001DAFB0,00000208), ref: 001A0ACC
                                                                                                                                                                                                              • wsprintfW.USER32(001DADA0,%s\Microsoft\%s.exe,00000000,00000000), ref: 001A0ADE
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,001DADA0,000000FF,001DAC50,00000104,00000000,00000000), ref: 001A0B06
                                                                                                                                                                                                              • lstrcpynW.KERNEL32(001DB1B8,00000000,00000208), ref: 001A0B13
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,001DB3E0,00000104,00000000,00000000), ref: 001A0B2E
                                                                                                                                                                                                              • Sleep.KERNEL32(000009C4), ref: 001A0B59
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 001A0B70
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$Exitmemset$lstrlen$ByteCharErrorFileLastModuleMultiNameSleepWide_snprintf$CountExecuteHeapMutexOpenShellTick_vsnprintflstrcpynwsprintf
                                                                                                                                                                                                              • String ID: %08x$%s\Microsoft\%s.exe$30e44aa1$OPEN$ngrBot$running
                                                                                                                                                                                                              • API String ID: 2173303953-2917108782
                                                                                                                                                                                                              • Opcode ID: d6482a5601171ea475033e4743cf71af90eb78df3ae893914334efa1d4c2a79f
                                                                                                                                                                                                              • Instruction ID: 9a0cd52b194f6b5ef87699b4a3ad79f58a1469df102baf33cb58fdb2eab374ca
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6482a5601171ea475033e4743cf71af90eb78df3ae893914334efa1d4c2a79f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF511979B84304BBEB21A7B09C4BF9E3A689F56B41F404051F709E61D2EBF056C08B62
                                                                                                                                                                                                              Function 0019FE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000,001A037C,?,001A32E4,00000000,00000000,httpi), ref: 0019FE11
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FE40
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0019FE47
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FE5E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FE72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FE7C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000002), ref: 0019FE89
                                                                                                                                                                                                              • strtok.MSVCRT(?,001A19DC), ref: 0019FEA2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,001A1335), ref: 0019FEBB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A19DC), ref: 0019FECD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019FEE4
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,00000000,00000000), ref: 0019FEEF
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0019FF0A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FF14
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0019FF1F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FF33
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A3328), ref: 0019FF4B
                                                                                                                                                                                                              • strstr.MSVCRT(?,001A2B54), ref: 0019FF5C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019FF65
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FF6B
                                                                                                                                                                                                              • strncat.MSVCRT(00000000,?,00000000), ref: 0019FF77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A2B54), ref: 0019FF85
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FF8F
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0019FF9A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019FFAA
                                                                                                                                                                                                                • Part of subcall function 0019FD80: isalnum.MSVCRT(00000000,00000000,756F59EB,00000000,?,0019FFB9,00000000,00000000,00000000), ref: 0019FDAC
                                                                                                                                                                                                                • Part of subcall function 0019FD80: strchr.MSVCRT(-_.!~*'(),00000000,00000000), ref: 0019FDBE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 0019FFBE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019FFCB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0019FFDF
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A19DC), ref: 0019FFEC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 001A000F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A001C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A003C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 423345748-0
                                                                                                                                                                                                              • Opcode ID: e7dfe69fed0a900bfbfb86b39500c616aaed61ac2c5e96ff7df8d604bd966be0
                                                                                                                                                                                                              • Instruction ID: 36ee253c5290b847d76fbcc4214f19cb119e7bdbbca083eeb8d8ca4a14f9d519
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7dfe69fed0a900bfbfb86b39500c616aaed61ac2c5e96ff7df8d604bd966be0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1616F7AA00215BBDB119FA4DC89EBF7778EF8A750F104119F908E7240DB74DD818BA1
                                                                                                                                                                                                              Function 001999B0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 205networkstringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 001999D5
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 001999EF
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000002,?), ref: 00199A00
                                                                                                                                                                                                                • Part of subcall function 00199300: inet_addr.WS2_32(0019226E), ref: 00199308
                                                                                                                                                                                                                • Part of subcall function 00199300: gethostbyname.WS2_32(0019226E), ref: 00199313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 00199A28
                                                                                                                                                                                                              • GetTickCount.KERNEL32(00000050,?), ref: 00199A3A
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00199A4D
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000000), ref: 00199A7B
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00199A96
                                                                                                                                                                                                              • connect.WS2_32(?,?,00000010), ref: 00199AB1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 00199ABE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00199AC4
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,X-a: b), ref: 00199AFE
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Connection: Close), ref: 00199B0C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00199B0F
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 00199B41
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000), ref: 00199B51
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00199B5E
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00199B66
                                                                                                                                                                                                              • Sleep.KERNEL32(000009C4), ref: 00199B7F
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 00199BBE
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?,00000000,00000000,00000000), ref: 00199BD2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00199BE4
                                                                                                                                                                                                              • send.WS2_32(?,00000000,00000000,00000000), ref: 00199C1E
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00199C38
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?,?,00000000,00000000,00000000), ref: 00199C43
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleeplstrlensend$lstrcpymemset$Startupclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
                                                                                                                                                                                                              • String ID: Connection: Close$X-a: b
                                                                                                                                                                                                              • API String ID: 1989272289-3524857483
                                                                                                                                                                                                              • Opcode ID: 63da2161575344037698fe8f188999e8e6b55d52d3b616026e4f87774887c17a
                                                                                                                                                                                                              • Instruction ID: 1cdcb32802e249bc35dcd1bb943a8843eb99ed7aeceb0dec013e3932f9f1c97c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 63da2161575344037698fe8f188999e8e6b55d52d3b616026e4f87774887c17a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F710876900218BBDB21EBB4DC45FDE73A9EB99700F014959EA0AE3180D770AE81CF91
                                                                                                                                                                                                              Function 0019AFA0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 149stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0019AFBD
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0019AFCB
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 0019AFE8
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF), ref: 0019B002
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019B013
                                                                                                                                                                                                              • sscanf.MSVCRT(00000000,POST /%1023s,00000000,00000000,?,00000000), ref: 0019B02A
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 0019B041
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,Host: ,00000006), ref: 0019B05B
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 0019B06E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000006), ref: 0019B082
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,-00000006,00000001), ref: 0019B08E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019B09B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019B0AD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019B0BB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019B0C6
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,?), ref: 0019B0D5
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,HTTP,00000004), ref: 0019B0EB
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,?,http://%s/,00000000), ref: 0019B106
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,?,http://%s/%s,00000000,00000000), ref: 0019B125
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019B13C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Alloc_memicmp_snprintfmemsetstrtok$Freelstrcpynsscanf
                                                                                                                                                                                                              • String ID: HTTP$Host: $POST /%1023s$http://%s/$http://%s/%s
                                                                                                                                                                                                              • API String ID: 3179755921-1264106924
                                                                                                                                                                                                              • Opcode ID: 47b09c5cb8e60c69799eca76b5ccca1b21b3b170a7a05c6be732d1f2c758407a
                                                                                                                                                                                                              • Instruction ID: 2b8c500798ab3a48e9922f84c58c19bdbc8acbac5b8e1f673b9fdf293a2c6823
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 47b09c5cb8e60c69799eca76b5ccca1b21b3b170a7a05c6be732d1f2c758407a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3441E7FA9412187BDB21E764AD42FAA73BCDF59710F044594FB08A3141E7705E498BF1
                                                                                                                                                                                                              Function 00196A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 00196A68
                                                                                                                                                                                                              • lstrlenA.KERNEL32 ref: 00196B03
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,00000000,00000000), ref: 00196B0E
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,JOIN,00000004), ref: 00196B22
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,PRIVMSG,00000007), ref: 00196B36
                                                                                                                                                                                                              • sscanf.MSVCRT(?,JOIN %255s,?), ref: 00196B4F
                                                                                                                                                                                                              • sscanf.MSVCRT(?,PRIVMSG %255s,?), ref: 00196B69
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00196BD5
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(001DA710,00000080), ref: 00196C31
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(001DA710,00000000,00000004), ref: 00196C40
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00196C60
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00196C67
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT ref: 0019A335
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT ref: 0019A34F
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT(?,00000000,000003FF), ref: 0019A369
                                                                                                                                                                                                                • Part of subcall function 0019A310: _vsnprintf.MSVCRT(?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A382
                                                                                                                                                                                                                • Part of subcall function 0019A310: sprintf.MSVCRT(00000000,001A13EC,?,?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A39A
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s,blk,?,?,000001FE,001A0A8E), ref: 0019A3AD
                                                                                                                                                                                                                • Part of subcall function 0019A310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s), ref: 0019A3CC
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB), ref: 0019A3DB
                                                                                                                                                                                                                • Part of subcall function 0019A310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 0019A3EC
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A3FB
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A404
                                                                                                                                                                                                                • Part of subcall function 0019A310: EnterCriticalSection.KERNEL32(001DAC34,?,?,00000000), ref: 0019A436
                                                                                                                                                                                                                • Part of subcall function 0019A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0019A452
                                                                                                                                                                                                                • Part of subcall function 0019A310: LeaveCriticalSection.KERNEL32(001DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
                                                                                                                                                                                                              • String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
                                                                                                                                                                                                              • API String ID: 1085873876-1467418891
                                                                                                                                                                                                              • Opcode ID: a09a2f163b6cbe4d698297622c59c2d940852ff467d430048c544a76efce2cdd
                                                                                                                                                                                                              • Instruction ID: d3507f5501012dd3880465f678abeecbd545c6bee7f005e7cdccc4f2fa9ec884
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a09a2f163b6cbe4d698297622c59c2d940852ff467d430048c544a76efce2cdd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF51F679E40204BBDF20DF648C86FAE37B8EF56744F444429F909E3181E775AA84C6B2
                                                                                                                                                                                                              Function 001A0050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,00000000,00000000,00000000), ref: 001A0071
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 001A0080
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A00AB
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 001A00B6
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 001A00CB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A00D2
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 001A00E3
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 001A00F9
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A19DC), ref: 001A0117
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A2B54), ref: 001A0129
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A2B84), ref: 001A0141
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,Content-Length: ,00000010), ref: 001A014E
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 001A0160
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000103,001A2B10,00000000), ref: 001A0177
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 001A018A
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 001A0193
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 001A01AB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 001A01B2
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 001A01BE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
                                                                                                                                                                                                              • String ID: $Content-Length:
                                                                                                                                                                                                              • API String ID: 4006885983-3599722475
                                                                                                                                                                                                              • Opcode ID: e4c596abb32984e789e0488076fd2d61d46644c94437bed047322d59ad663b71
                                                                                                                                                                                                              • Instruction ID: 4154b3388109d187a26e2021c42fb6ee627b77e9e6df28f1ef2714a9138073a0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4c596abb32984e789e0488076fd2d61d46644c94437bed047322d59ad663b71
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD412679A00318BBDB22AF749C45FEF776CEF5B711F004114FD08A6241E7B4CA858AA1
                                                                                                                                                                                                              Function 0019A310 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 127stringfilesleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0019A335
                                                                                                                                                                                                              • memset.MSVCRT ref: 0019A34F
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 0019A369
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A382
                                                                                                                                                                                                              • sprintf.MSVCRT(00000000,001A13EC,?,?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A39A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s,blk,?,?,000001FE,001A0A8E), ref: 0019A3AD
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s), ref: 0019A3CC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB), ref: 0019A3DB
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 0019A3EC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A3FB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A404
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(001DAC34,?,?,00000000), ref: 0019A436
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0019A452
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A464
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0019A484
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A48B
                                                                                                                                                                                                              • Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A496
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A4A1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CriticalSectionmemset$FileLeavesprintf$CloseCreateEnterHandleSleepWrite_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %d.$30e44aa1$\\.\pipe\%08x_ipc
                                                                                                                                                                                                              • API String ID: 4010528547-3602371622
                                                                                                                                                                                                              • Opcode ID: 9e61aad451b73f2782380b2f240efaa062ea667196991c94a36454e636f18524
                                                                                                                                                                                                              • Instruction ID: 9e91d6d6c790ce5589b06c6c1f1204aa36d2ee1fd3a357381316bed9ccb864ed
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e61aad451b73f2782380b2f240efaa062ea667196991c94a36454e636f18524
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AD41B6BA6802187BD711E7E4DC46FEA736CDF8A711F404494F708A60C1DBB06B848B65
                                                                                                                                                                                                              Function 001A01E0 Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 189memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF,00000000,00000000,00000000), ref: 001A0202
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 001A0213
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(001DB4E4), ref: 001A0223
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A19DC), ref: 001A0243
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A0254
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 001A025F
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 001A0272
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,), ref: 001A0281
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,%s=,001A32E4), ref: 001A02C8
                                                                                                                                                                                                              • strstr.MSVCRT(?,00000000), ref: 001A02EF
                                                                                                                                                                                                              • atoi.MSVCRT(00000000,?,http,int), ref: 001A0322
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A0386
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A03E4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A03EE
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DB4E4), ref: 001A03FD
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 001A041F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Freestrstr$CriticalSectionlstrlen$AllocEnterLeaveProcess_snprintfatoilstrcpymemset
                                                                                                                                                                                                              • String ID: $%s.%s hijacked!$%s=$http$httpi$httpspread$int$msg
                                                                                                                                                                                                              • API String ID: 2097228407-1593535274
                                                                                                                                                                                                              • Opcode ID: dfcb221260df072c2c3a7a92cae2b921b98330a864fe403b78e9af3830ee2acb
                                                                                                                                                                                                              • Instruction ID: 40a55cff8681b711438c60be264821dad6ef97c52591dd0ee2ac939fe0e47767
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dfcb221260df072c2c3a7a92cae2b921b98330a864fe403b78e9af3830ee2acb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B51D579A40319BFDF129BB09C85BBFB778FF5A704F044429F905A2241DB74AD408BA1
                                                                                                                                                                                                              Function 0019AE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00197CC2,00000000,001A2914,?,?,?,?,?,?), ref: 0019AE11
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001,?,00197CC2,00000000,001A2914,?,?,?,?,?,?,?,00000000), ref: 0019AE23
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 0019AE41
                                                                                                                                                                                                              • strstr.MSVCRT(?,001A19DC), ref: 0019AE59
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0019AE70
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0019AE77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A2B54), ref: 0019AE7F
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A19DC), ref: 0019AE8E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019AEA1
                                                                                                                                                                                                              • _strnicmp.MSVCRT(00000000,00000000,00000000), ref: 0019AEA6
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A19DC), ref: 0019AEB9
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019AED5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019AEEB
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A2B54), ref: 0019AF10
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0019AF20
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0019AF27
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000001), ref: 0019AF2B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0019AF3D
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000001), ref: 0019AF58
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 0019AF5F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 0019AF6B
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,00000001), ref: 0019AF82
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,00000001), ref: 0019AF91
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3119447416-0
                                                                                                                                                                                                              • Opcode ID: 154cced354676380e31c47128cabac101557dce1cc99414d47b35cb46a8ae576
                                                                                                                                                                                                              • Instruction ID: 7def8fdb3d5e74405ca505ddc9b61835024e3fef27037032a38dec9e2006fa06
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 154cced354676380e31c47128cabac101557dce1cc99414d47b35cb46a8ae576
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 04419D79A41214BBDB11DF689C81F6B37B8EF8A700F544019FE0497280DB75ED0587E6
                                                                                                                                                                                                              Function 0019D220 Relevance: 33.2, APIs: 11, Strings: 11, Instructions: 209stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstrstrtok$lstrcmplstrlen
                                                                                                                                                                                                              • String ID: 001$332$376$433$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
                                                                                                                                                                                                              • API String ID: 4048585210-3109762459
                                                                                                                                                                                                              • Opcode ID: 64f7a6f869eae7aa199aabd4f0875d790472fa38670b065b4b822754a767bab2
                                                                                                                                                                                                              • Instruction ID: 03825378b7e8076ac68392ab5739bb8f7eb841f98cdf253a3334905c114f0dd1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 64f7a6f869eae7aa199aabd4f0875d790472fa38670b065b4b822754a767bab2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3451E6BAB4420927DF10B778BC82EAA736CEBA5719F004565FC09D3242FB71E95146E2
                                                                                                                                                                                                              Function 001925D0 Relevance: 31.7, APIs: 7, Strings: 14, Instructions: 191stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • sscanf.MSVCRT(?,CAL %d %256s,?,001A7008), ref: 0019260F
                                                                                                                                                                                                                • Part of subcall function 001A07D0: lstrlenA.KERNEL32(0019262A,?,?,00000000,?,0019262A,?,001A7008), ref: 001A07DC
                                                                                                                                                                                                                • Part of subcall function 001A07D0: lstrcpyA.KERNEL32(00000000,0019262A,?,001A7008), ref: 001A07F9
                                                                                                                                                                                                              • strstr.MSVCRT(?,X-MMS-IM-Format:), ref: 0019264F
                                                                                                                                                                                                                • Part of subcall function 00197700: memset.MSVCRT(?,00000000,000001FF), ref: 0019771E
                                                                                                                                                                                                                • Part of subcall function 00197700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00197738
                                                                                                                                                                                                                • Part of subcall function 00197700: lstrlenA.KERNEL32(00000000), ref: 00197747
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 001926FB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 00192713
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019276B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,00000000), ref: 0019278C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001927F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$atoi$FreeHeap_snprintflstrcpymemsetsscanfstrstr
                                                                                                                                                                                                              • String ID: %s.p10-> Message hijacked!$%s.p10-> Message to %s hijacked!$%s.p21-> Message hijacked!$CAL $CAL %d %256s$MSG $MSG $SDG $X-MMS-IM-Format:$baddr$msn$msnint$msnmsg$msnu
                                                                                                                                                                                                              • API String ID: 1527159713-2027340701
                                                                                                                                                                                                              • Opcode ID: fe9e5902fad50cabbd23139855700e38af811ae9e05a0bd9e28c4efd4e125480
                                                                                                                                                                                                              • Instruction ID: feeab96b19f5fd67d381ed4f1a5d7d3eeacfdf463b4dcd1706d611f73e95bf22
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe9e5902fad50cabbd23139855700e38af811ae9e05a0bd9e28c4efd4e125480
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E515C7AE4420177CF216BE46C82DEE77A4EB67720F548429FC08A2682E7759A418793
                                                                                                                                                                                                              Function 00197C00 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 175stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A19DC,00000000,00000000), ref: 00197C62
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 00197D58
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,WHM), ref: 00197D71
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,WHCMS), ref: 00197D8A
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,Directadmin), ref: 00197DA3
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT ref: 0019A335
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT ref: 0019A34F
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT(?,00000000,000003FF), ref: 0019A369
                                                                                                                                                                                                                • Part of subcall function 0019A310: _vsnprintf.MSVCRT(?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A382
                                                                                                                                                                                                                • Part of subcall function 0019A310: sprintf.MSVCRT(00000000,001A13EC,?,?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A39A
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s,blk,?,?,000001FE,001A0A8E), ref: 0019A3AD
                                                                                                                                                                                                                • Part of subcall function 0019A310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s), ref: 0019A3CC
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB), ref: 0019A3DB
                                                                                                                                                                                                                • Part of subcall function 0019A310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 0019A3EC
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A3FB
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A404
                                                                                                                                                                                                                • Part of subcall function 0019A310: EnterCriticalSection.KERNEL32(001DAC34,?,?,00000000), ref: 0019A436
                                                                                                                                                                                                                • Part of subcall function 0019A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0019A452
                                                                                                                                                                                                                • Part of subcall function 0019A310: LeaveCriticalSection.KERNEL32(001DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A464
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00197E02
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 00197E12
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF), ref: 00197401
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00197419
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 00197431
                                                                                                                                                                                                                • Part of subcall function 001973E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00197449
                                                                                                                                                                                                                • Part of subcall function 001973E0: _vsnprintf.MSVCRT(?,000001FE,001A0A8E,?), ref: 0019746B
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 0019747A
                                                                                                                                                                                                                • Part of subcall function 00197330: memset.MSVCRT(?,00000000,000001FF), ref: 00197351
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(?), ref: 00197369
                                                                                                                                                                                                                • Part of subcall function 00197330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00197381
                                                                                                                                                                                                                • Part of subcall function 00197330: _vsnprintf.MSVCRT(00000000,000001FE,001A0AAD,?), ref: 001973A3
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(00000000), ref: 001973B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
                                                                                                                                                                                                              • String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
                                                                                                                                                                                                              • API String ID: 3716863481-3153587688
                                                                                                                                                                                                              • Opcode ID: 69e4d1b934ac03da34487f6cde1f30bb1455a6b7ec6e2251fc5aa52a8275ca37
                                                                                                                                                                                                              • Instruction ID: 18663d1017293eba5197162d7c8f649a7417c8fd84bf32f54359d137b643ae52
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 69e4d1b934ac03da34487f6cde1f30bb1455a6b7ec6e2251fc5aa52a8275ca37
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3F51AFB9E14215BBDF10DB949D82DBB73ACAF5A701F484418B806A3281E770EE45CBB1
                                                                                                                                                                                                              Function 0019EFE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 106stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetFileAttributesA.KERNEL32(?), ref: 0019EFF4
                                                                                                                                                                                                              • memset.MSVCRT ref: 0019F011
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000007FF), ref: 0019F02B
                                                                                                                                                                                                              • PathFindExtensionA.SHLWAPI(?,.lnk), ref: 0019F039
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000), ref: 0019F046
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,001A13D8), ref: 0019F056
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,001A2FCC), ref: 0019F066
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,RECYCLED), ref: 0019F08F
                                                                                                                                                                                                              • strrchr.MSVCRT(?,0000005C), ref: 0019F09C
                                                                                                                                                                                                              • strrchr.MSVCRT(?,0000005C,?,0000005C), ref: 0019F0A9
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000007FF,/c "start %%cd%%RECYCLED\%s,00000001), ref: 0019F0CC
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000007FF,&&%%windir%%\explorer.exe %%cd%%%s,00000001,?,000007FF,/c "start %%cd%%RECYCLED\%s,00000001), ref: 0019F0E4
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000006), ref: 0019F109
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmp$AttributesFile_snprintfmemsetstrrchr$ExtensionFindPath
                                                                                                                                                                                                              • String ID: %windir%\system32\cmd.exe$&&%%windir%%\explorer.exe %%cd%%%s$.lnk$/c "start %%cd%%RECYCLED\%s$RECYCLED
                                                                                                                                                                                                              • API String ID: 1691573101-2902080580
                                                                                                                                                                                                              • Opcode ID: aa4756e0c0fd2568b084d5fe1ad8488c8edb576f14b3044c921ec93927b1fdd3
                                                                                                                                                                                                              • Instruction ID: b8a025aa612ddea6c307887b3bb4b08d087d65b3ea5e1ca6fdc1fe41bad4503a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa4756e0c0fd2568b084d5fe1ad8488c8edb576f14b3044c921ec93927b1fdd3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3831A9766443157EEB21B668DC06FEB736CEF5AB41F040478FA08E20C5DBB499858AF1
                                                                                                                                                                                                              Function 0019E590 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 141stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019E5B0
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(001DB3C8), ref: 0019E5C9
                                                                                                                                                                                                              • strtok.MSVCRT(?,001A2B84), ref: 0019E5FE
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A13D8), ref: 0019E617
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A2C78), ref: 0019E62D
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A13D8), ref: 0019E642
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019E655
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0019E65B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,001A1335), ref: 0019E678
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0019E687
                                                                                                                                                                                                                • Part of subcall function 00197500: lstrlenA.KERNEL32(?), ref: 0019752B
                                                                                                                                                                                                                • Part of subcall function 00197500: _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 00197547
                                                                                                                                                                                                                • Part of subcall function 00197500: _vsnprintf.MSVCRT(?,000001FF,00000000,?), ref: 00197569
                                                                                                                                                                                                                • Part of subcall function 00197500: lstrcmpA.KERNEL32(?,bdns), ref: 0019758B
                                                                                                                                                                                                                • Part of subcall function 00197500: StrStrIA.SHLWAPI(?,00000000), ref: 0019759F
                                                                                                                                                                                                                • Part of subcall function 00197500: lstrlenA.KERNEL32(?), ref: 001975B9
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A2B84), ref: 0019E6CF
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019E71E
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0019E72D
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DB3C8), ref: 0019E73A
                                                                                                                                                                                                                • Part of subcall function 0019AA10: memset.MSVCRT(?,00000000,00000103), ref: 0019AA31
                                                                                                                                                                                                                • Part of subcall function 0019AA10: lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0019AA45
                                                                                                                                                                                                                • Part of subcall function 0019AA10: InternetOpenA.WININET(00000000,?,?,?,?), ref: 0019AA60
                                                                                                                                                                                                                • Part of subcall function 0019AA10: lstrlenA.KERNEL32(?), ref: 0019AA78
                                                                                                                                                                                                                • Part of subcall function 0019AA10: InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0019AA8C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$strstr$CriticalInternetOpenSectionlstrcpymemsetstrtok$??3@EnterFreeHeapLeave_snprintf_vsnprintflstrcmplstrcpyn
                                                                                                                                                                                                              • String ID: [DNS]: Blocked %d domain(s) - Redirected %d domain(s)$bdns$block
                                                                                                                                                                                                              • API String ID: 1940452476-536441337
                                                                                                                                                                                                              • Opcode ID: 31abde84990ba9225964e899385fc260cbe4162d8340c789ea8a2879316d7584
                                                                                                                                                                                                              • Instruction ID: 34a2d76ea0250a9b97e7e12d8dabb845738e83eebcc6c05efd0e60679871aa19
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 31abde84990ba9225964e899385fc260cbe4162d8340c789ea8a2879316d7584
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2541D5B9D40308BBCF11EBA4DC86CEE77B9EFA6710F144555F905A2242E7719A4086A1
                                                                                                                                                                                                              Function 0019B300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 129stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000208), ref: 0019B312
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 0019B319
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206), ref: 0019B339
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206,?,00000000,00000206), ref: 0019B354
                                                                                                                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000208), ref: 0019B387
                                                                                                                                                                                                              • lstrcpynW.KERNEL32(?,?,00000004), ref: 0019B3A1
                                                                                                                                                                                                              • GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0019B3BB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0019B3D8
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0019B3F0
                                                                                                                                                                                                              • lstrcatW.KERNEL32(00000000,.exe), ref: 0019B461
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlenmemset$AllocDirectoryInformationProcessVolumeWindowslstrcatlstrcpyn
                                                                                                                                                                                                              • String ID: .exe$30e44aa1$lol$lol.exe
                                                                                                                                                                                                              • API String ID: 1748614950-52295467
                                                                                                                                                                                                              • Opcode ID: 94fe66d8cf546e89e716136c2b935b7232311fe79952f1ec6a58c5b910321f50
                                                                                                                                                                                                              • Instruction ID: f3f37d49ca1168da1ad36f89155cfc65b07976ef5f1a22f7dfabc880915a17ba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94fe66d8cf546e89e716136c2b935b7232311fe79952f1ec6a58c5b910321f50
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C416B71605328BBCB20CBB9DD45AEFBBB9EF85311F0081A6F918D6151E3788B40D7A5
                                                                                                                                                                                                              Function 0019AA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019AA31
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0019AA45
                                                                                                                                                                                                              • InternetOpenA.WININET(00000000,?,?,?,?), ref: 0019AA60
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019AA78
                                                                                                                                                                                                              • InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0019AA8C
                                                                                                                                                                                                              • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 0019AAC0
                                                                                                                                                                                                              • InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 0019AAE2
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00001000), ref: 0019AB15
                                                                                                                                                                                                              • InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 0019AB67
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(?), ref: 0019AB85
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0019ABA5
                                                                                                                                                                                                              • InternetCloseHandle.WININET(00000000), ref: 0019ABE7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
                                                                                                                                                                                                              • String ID: Mozilla/4.0
                                                                                                                                                                                                              • API String ID: 2392773942-2634101963
                                                                                                                                                                                                              • Opcode ID: 34d1a88751a85b13f43de96e26bb7b3f54ae2ded0ed3b36c14c85a01c81a4070
                                                                                                                                                                                                              • Instruction ID: c09dee5b7213d335d7198edbde2b43eec6ba274c037cf723bb9d7c39db68799b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 34d1a88751a85b13f43de96e26bb7b3f54ae2ded0ed3b36c14c85a01c81a4070
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E051BD75A06205EFDB20CF69EC84BAA77E8EF89700F15406EE80AD7650D770A984DF91
                                                                                                                                                                                                              Function 0019EE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CoCreateInstance.OLE32(001A3634,00000000,00000001,001A3614,?), ref: 0019EE5B
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000207), ref: 0019EE81
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0019EE9A
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A2C78), ref: 0019EEAE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0019EEBB
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,0000015C), ref: 0019EED5
                                                                                                                                                                                                              • SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 0019EEF4
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000107), ref: 0019EF68
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0019EF7B
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,.lnk), ref: 0019EF89
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0019EFA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
                                                                                                                                                                                                              • String ID: .lnk$shell32.dll
                                                                                                                                                                                                              • API String ID: 3196525290-3399515747
                                                                                                                                                                                                              • Opcode ID: 3b3af0aa596509fc33149bcef381218fa3a4039be71105c20fa7a62d594c24e0
                                                                                                                                                                                                              • Instruction ID: 01dc63c34b07b2f9d65277e4f02f9c45ef7cf1d5a24118a17472a66d73704ce8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3b3af0aa596509fc33149bcef381218fa3a4039be71105c20fa7a62d594c24e0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A512475A40218BFDB51DB94CC85FDAB3B9AF8D700F104588F608EB290D7B1AE85CB64
                                                                                                                                                                                                              Function 00192220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 00192243
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 00192257
                                                                                                                                                                                                                • Part of subcall function 00199300: inet_addr.WS2_32(0019226E), ref: 00199308
                                                                                                                                                                                                                • Part of subcall function 00199300: gethostbyname.WS2_32(0019226E), ref: 00199313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 00192288
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00192297
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 001922AE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 001922C3
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 001922F4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00192307
                                                                                                                                                                                                              • send.WS2_32(00000000,00000000,00000400,00000000), ref: 00192344
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00192350
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 00192363
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
                                                                                                                                                                                                              • String ID: gfff$i.root-servers.org
                                                                                                                                                                                                              • API String ID: 99835129-3534201491
                                                                                                                                                                                                              • Opcode ID: 368988bdcefe3554ea73afa2a72b66583b20ad5aa30eff46ea30bd2dbeb6211c
                                                                                                                                                                                                              • Instruction ID: 8e6d76c56ffed6a80cf1374284acdff1f2c09c09da649c3ffdfd65e854662f5c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 368988bdcefe3554ea73afa2a72b66583b20ad5aa30eff46ea30bd2dbeb6211c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E3148B2B002086BDF14E67D9C42BBEB2A99F99710F444565FA0CE72C1EBB19E4147D2
                                                                                                                                                                                                              Function 00199830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 00199850
                                                                                                                                                                                                              • strtok.MSVCRT(?,001A29EC), ref: 0019986E
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019988B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 001998A8
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A29EC), ref: 001998B5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 001998D1
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019999C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 0019993A
                                                                                                                                                                                                              • [UDP]: Finished flood on "%s:%d", xrefs: 00199970
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-2644890838
                                                                                                                                                                                                              • Opcode ID: 97b5783eaed3aa73c6b5dfb5cc99eac700fbb60c2e442480eedbadc96bf52e98
                                                                                                                                                                                                              • Instruction ID: 98b04cbd688a156a81def0de75c0ca2fc3186add00f4cc81063f6dfe3f47b841
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 97b5783eaed3aa73c6b5dfb5cc99eac700fbb60c2e442480eedbadc96bf52e98
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 503107FA6042087BDB20A7B5AC46F6B336DEB56709F44012DFE08A2182D7719D4087B6
                                                                                                                                                                                                              Function 001996B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 001996D0
                                                                                                                                                                                                              • strtok.MSVCRT(?,001A29EC), ref: 001996EE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019970B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 00199728
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A29EC), ref: 00199735
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 00199751
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019981C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [SYN]: Finished flood on "%s:%d", xrefs: 001997F0
                                                                                                                                                                                                              • [SYN]: Starting flood on "%s:%d" for %d second(s), xrefs: 001997BA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [SYN]: Finished flood on "%s:%d"$[SYN]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-3475151101
                                                                                                                                                                                                              • Opcode ID: 2559959ed3f8953d009703d9b2d045d663afe18bb780d3b9ce1350fad8462c31
                                                                                                                                                                                                              • Instruction ID: b8e1085b2e3fc0f214f20228ec88009cd7d4b591a2af497699c7ecc03423bad8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2559959ed3f8953d009703d9b2d045d663afe18bb780d3b9ce1350fad8462c31
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D73109FA6442087BDB20E7B4AC46F7B336DEB56705F04016DFE09A2182D7719D408BB5
                                                                                                                                                                                                              Function 001912B5 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 108COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32 ref: 001912BE
                                                                                                                                                                                                              • wcsstr.MSVCRT(?,001A1378,?,?,?,?,?,?,?), ref: 001912FD
                                                                                                                                                                                                              • wcsstr.MSVCRT(?,\\.\pipe), ref: 00191313
                                                                                                                                                                                                              • wcsstr.MSVCRT(?,DBWIN), ref: 00191325
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(?,00000080), ref: 00191368
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(?,00000000,00000004,?,00000080), ref: 00191373
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Filewcsstr$Attributes$Move
                                                                                                                                                                                                              • String ID: %s.%S$DBWIN$\\.\pipe$brk$dll$exe$ruskill
                                                                                                                                                                                                              • API String ID: 3850124382-1976196219
                                                                                                                                                                                                              • Opcode ID: fe769965e5e600c4319e72bf0cba48c4455828a061949ab3ca78408eda1e0c3e
                                                                                                                                                                                                              • Instruction ID: 5e1933472dcf6766d976532e4eb0e22553d69955bdc2799bf31bfc867246875b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe769965e5e600c4319e72bf0cba48c4455828a061949ab3ca78408eda1e0c3e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD310A79780313BBDF109F609C46F9E3268FF67732F040124F94492A81FB659A8982A2
                                                                                                                                                                                                              Function 001A0C80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100memorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 001A0C89
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,001DAA28,00000104), ref: 001A0C9F
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,001DA710,00000208), ref: 001A0CB0
                                                                                                                                                                                                              • GetWindowsDirectoryA.KERNEL32(001DAB30,00000104), ref: 001A0CC0
                                                                                                                                                                                                                • Part of subcall function 001919F0: wcsrchr.MSVCRT(?,0000005C,?,00196965,?,?,?), ref: 001919F9
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(001DAC34), ref: 001A0CE3
                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(001DB4E4), ref: 001A0CEA
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(001DA710,00000000,00000004), ref: 001A0DA5
                                                                                                                                                                                                                • Part of subcall function 0019A150: memset.MSVCRT(?,00000000,00000206,00000000), ref: 0019A170
                                                                                                                                                                                                                • Part of subcall function 0019A150: GetWindowsDirectoryW.KERNEL32(?,00000208,?,?,00000000), ref: 0019A184
                                                                                                                                                                                                                • Part of subcall function 0019A150: _memicmp.MSVCRT(001DA710,?,00000000,?,00000000,?,?,00000000), ref: 0019A1C3
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(001DA710,00000080), ref: 001A0D96
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000E9F0,00000000,00000000,00000000), ref: 001A0DED
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 001A0DF4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CriticalDirectoryInitializeModuleNameSectionWindows$AttributesCloseCreateHandleHeapMoveProcessThread_memicmpmemsetwcsrchr
                                                                                                                                                                                                              • String ID: %s.%S$brk$ruskill
                                                                                                                                                                                                              • API String ID: 2870590860-2269373653
                                                                                                                                                                                                              • Opcode ID: 08139ef9f30af43cedc0a08ec228795b8bce6675470b69d679760796202536e5
                                                                                                                                                                                                              • Instruction ID: 3c044ddb503f2f9505efb1d6c9e8f0b233d411c702bc7a2f55ee60319e108377
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 08139ef9f30af43cedc0a08ec228795b8bce6675470b69d679760796202536e5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F93108397C1300B7DB21ABF06D47F1A37A4AF1BF55F440422F60296AD2D7B570818663
                                                                                                                                                                                                              Function 0019A880 Relevance: 22.6, APIs: 2, Strings: 13, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF), ref: 0019A89E
                                                                                                                                                                                                                • Part of subcall function 00197790: memset.MSVCRT(?,00000000,00000103), ref: 001977AE
                                                                                                                                                                                                                • Part of subcall function 00197790: memset.MSVCRT(?,00000000,000001FF,?,00000000,00000103), ref: 001977C8
                                                                                                                                                                                                                • Part of subcall function 00197790: lstrcpyA.KERNEL32(00000000,off), ref: 001977F0
                                                                                                                                                                                                                • Part of subcall function 00197790: _snprintf.MSVCRT(00000000,000001FF,state_%s,?), ref: 0019780D
                                                                                                                                                                                                                • Part of subcall function 00197790: lstrlenA.KERNEL32(00000000), ref: 00197822
                                                                                                                                                                                                                • Part of subcall function 00197790: lstrlenA.KERNEL32(00000000), ref: 00197858
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,001A2B10,00000539,httpi,00000001,usbi,00000000,bdns,00000001), ref: 0019A936
                                                                                                                                                                                                                • Part of subcall function 00197500: lstrlenA.KERNEL32(?), ref: 0019752B
                                                                                                                                                                                                                • Part of subcall function 00197500: _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 00197547
                                                                                                                                                                                                                • Part of subcall function 00197500: _vsnprintf.MSVCRT(?,000001FF,00000000,?), ref: 00197569
                                                                                                                                                                                                                • Part of subcall function 00197500: lstrcmpA.KERNEL32(?,bdns), ref: 0019758B
                                                                                                                                                                                                                • Part of subcall function 00197500: StrStrIA.SHLWAPI(?,00000000), ref: 0019759F
                                                                                                                                                                                                                • Part of subcall function 00197500: lstrlenA.KERNEL32(?), ref: 001975B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintfmemset$_vsnprintflstrcmplstrcpy
                                                                                                                                                                                                              • String ID: bdns$ffgrab$ftpgrab$http$httpi$iegrab$int$msg$msn$msnu$pdef$popgrab$usbi
                                                                                                                                                                                                              • API String ID: 3955240783-2907616027
                                                                                                                                                                                                              • Opcode ID: a528b64a8430890a7dfc31e3a6e80685893a6d7eab2e39c90ccea5712fe93805
                                                                                                                                                                                                              • Instruction ID: 724f24ddbebe1e7be3b8408d1d4de67aa2dd530e933d424cac11faee2e332e89
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a528b64a8430890a7dfc31e3a6e80685893a6d7eab2e39c90ccea5712fe93805
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 12111E7CBF930676EE65B6E44CCBFD932655F66F14F000494B608B91C2ABF52580817A
                                                                                                                                                                                                              Function 001917E0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019180E
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206,?,00000000,00000103), ref: 00191829
                                                                                                                                                                                                              • wcsstr.MSVCRT(00000000,001A13F0), ref: 00191842
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 00191888
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A13D8), ref: 00191898
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000208), ref: 001918B7
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 00191905
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememset$lstrcmpstrstrwcsstr
                                                                                                                                                                                                              • String ID: %s.%S$bdns$block$brk$rdns
                                                                                                                                                                                                              • API String ID: 695720605-4000218262
                                                                                                                                                                                                              • Opcode ID: 8f8b73139f561e19a4fee5b81e1262b9d5291b12d5c9f8f02d81b635f083ab4b
                                                                                                                                                                                                              • Instruction ID: 0a5b4318ca87faafa471c291d145c00327a777e571acc97e1a4e70a95dc44c85
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f8b73139f561e19a4fee5b81e1262b9d5291b12d5c9f8f02d81b635f083ab4b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1511779A40205BBDF20EF54DC06FEB37ACEF5A715F044169F914922C1E7B09A84CBA2
                                                                                                                                                                                                              Function 001910A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 001910C0
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,001DADA0), ref: 001910D7
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,001DA710), ref: 0019111D
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00191127
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 00191161
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001A6D88,00000000), ref: 00191179
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,001A1335), ref: 00191187
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 001911A0
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001A6E90,00000000), ref: 001911B3
                                                                                                                                                                                                                • Part of subcall function 00197700: memset.MSVCRT(?,00000000,000001FF), ref: 0019771E
                                                                                                                                                                                                                • Part of subcall function 00197700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00197738
                                                                                                                                                                                                                • Part of subcall function 00197700: lstrlenA.KERNEL32(00000000), ref: 00197747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcpy$ByteCharMultiWidelstrcmpmemset$FileMove_snprintflstrlen
                                                                                                                                                                                                              • String ID: %s.%S$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 1230166232-1410347113
                                                                                                                                                                                                              • Opcode ID: 94324b48c45b3cb1dd29b7421560dcb0fcd788a80c853a1817a78f3b846bacea
                                                                                                                                                                                                              • Instruction ID: c977f9adcc0a8521fa9b2add37fb2911f156b8f64fab450bb3abc40c289d2305
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94324b48c45b3cb1dd29b7421560dcb0fcd788a80c853a1817a78f3b846bacea
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C231B6B97403157BEB20DB649C86FEA736CAF56F10F040165FB54A61C0D7F0ADC48665
                                                                                                                                                                                                              Function 001973E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF), ref: 00197401
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00197419
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00197431
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00197449
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(?,000001FE,001A0A8E,?), ref: 0019746B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019747A
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,block,00000004), ref: 001974B0
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(?,000001FE,001A0A8E,?), ref: 001974D0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _vsnprintflstrlenmemset$_memicmp_snprintf
                                                                                                                                                                                                              • String ID: %s.%s$%s_$blk$block
                                                                                                                                                                                                              • API String ID: 3657324510-3589362310
                                                                                                                                                                                                              • Opcode ID: 14f60723e35a76e9d905c7ac343dcc4493cdf6360fd0a7d96eee0b419bd22785
                                                                                                                                                                                                              • Instruction ID: 30bee4d087522dc147d0e1198f502588b438fe9c10a5c2e0ef9723d1355da218
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14f60723e35a76e9d905c7ac343dcc4493cdf6360fd0a7d96eee0b419bd22785
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DD2133B694021D7BEB11EA58DC82FFB33ACEF59714F4445ACBA0893182E7709E4587B0
                                                                                                                                                                                                              Function 00199580 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 001995A4
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000007FF), ref: 001995BE
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,000007FF), ref: 001995D8
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 001995E0
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,Mozilla/4.0), ref: 00199611
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,GET), ref: 00199664
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42,?,?,?,?), ref: 00199685
                                                                                                                                                                                                              • strtok.MSVCRT(?,001A2960,?,%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42,?,?,?,?), ref: 00199696
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: memset$lstrcpy$CountTicksprintfstrtok
                                                                                                                                                                                                              • String ID: %s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42$GET$Mozilla/4.0$POST
                                                                                                                                                                                                              • API String ID: 3318893083-109246470
                                                                                                                                                                                                              • Opcode ID: 68750925022264f2c301a332ae9b990eba7f1a75968df9051aaeeeae6a1997b1
                                                                                                                                                                                                              • Instruction ID: a7fa9183b60ecb25f6751c17d9a6d07dad8a235a2052debef9f4d731f278605b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68750925022264f2c301a332ae9b990eba7f1a75968df9051aaeeeae6a1997b1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D021EABA9402186ADB25D668CC46FDA736CAFBE705F004589F349A2181D7B0ABC48A61
                                                                                                                                                                                                              Function 00198270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00198292
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 001982A8
                                                                                                                                                                                                                • Part of subcall function 001981C0: WSAStartup.WS2_32(00000202,?), ref: 001981E3
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 00198314
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupselect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3882035529-0
                                                                                                                                                                                                              • Opcode ID: a7c08fde7b161c78f61cb5632dbf80c219f5210ba4301c066be082df35d9259f
                                                                                                                                                                                                              • Instruction ID: 83e14245d4c93d275cec55c8cc5987e1f400d01249fd16be914e567d22676aa7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a7c08fde7b161c78f61cb5632dbf80c219f5210ba4301c066be082df35d9259f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1A1E7B1900204ABDB34DF68D885AEBB3F9EF59310F00451EF59DC7241DB74AA85CBA1
                                                                                                                                                                                                              Function 00196F70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 125stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FE), ref: 00196F91
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,HKCU\), ref: 00196FFE
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000400), ref: 00197017
                                                                                                                                                                                                              • _wcsnicmp.MSVCRT(?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,Software\Microsoft\Windows\CurrentVersion\Run), ref: 00197061
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWide_wcsnicmplstrcpymemset
                                                                                                                                                                                                              • String ID: %S%s%s$%s.%s%s$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
                                                                                                                                                                                                              • API String ID: 2911520168-3007424447
                                                                                                                                                                                                              • Opcode ID: 308710253148418fa5ef8f01395bb32c1460e6945a65ecc0fa0590c285c12fe0
                                                                                                                                                                                                              • Instruction ID: c07fb0e7880b1ae1ddb07d2eb84417243be41da68826b55453c0170d264feca8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 308710253148418fa5ef8f01395bb32c1460e6945a65ecc0fa0590c285c12fe0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1417FB6A54218BBDF10DFA4DC42EEE77B9BF59714F08015AF904E2281E770AA4087B5
                                                                                                                                                                                                              Function 0019E880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84pipestringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 0019E8A0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0019E8AD
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000400,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000), ref: 0019E8D0
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0019E8FF
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 0019E913
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019E91D
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D7A0,00000000,00000000,00000000), ref: 0019E941
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019E94B
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0019E96E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateNamedPipe$CloseConnectErrorHandleLastThread_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: 30e44aa1$\\.\pipe\%08x_ipc
                                                                                                                                                                                                              • API String ID: 4065143564-1096776489
                                                                                                                                                                                                              • Opcode ID: 5691b2e9de4447733ce9b9bddc13a827615606a61143cfe0d559293402d20322
                                                                                                                                                                                                              • Instruction ID: 0a9b7a7f7da9f5a6636178ee326b272423fbf73b873c95aa385e70a2f8187256
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5691b2e9de4447733ce9b9bddc13a827615606a61143cfe0d559293402d20322
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A2154757C03157EF730A3B48C47FAA3698AB16F64F644660FB04FA0C0EBF069454AA8
                                                                                                                                                                                                              Function 0019FB60 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 106windowregistryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterClassExA.USER32(?), ref: 0019FC05
                                                                                                                                                                                                              • CreateWindowExA.USER32(00000000,gdkWindowToplevelClass,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019FC20
                                                                                                                                                                                                              • RegisterDeviceNotificationA.USER32(00000000,00000020,00000000), ref: 0019FC30
                                                                                                                                                                                                              • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0019FC48
                                                                                                                                                                                                              • TranslateMessage.USER32(?), ref: 0019FC61
                                                                                                                                                                                                              • DispatchMessageA.USER32(?), ref: 0019FC67
                                                                                                                                                                                                              • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0019FC74
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$Register$ClassCreateDeviceDispatchNotificationTranslateWindow
                                                                                                                                                                                                              • String ID: $0$gdkWindowToplevelClass
                                                                                                                                                                                                              • API String ID: 2947200908-2026830438
                                                                                                                                                                                                              • Opcode ID: 16fae9d5c95a6abeb14f768dbe509aa0a7ab224f605c163a6579833662f23d6a
                                                                                                                                                                                                              • Instruction ID: e090ca8a32f4dc728523e40c5dfd1cfb1085ef9feb2773cbe16f697ad98941ff
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 16fae9d5c95a6abeb14f768dbe509aa0a7ab224f605c163a6579833662f23d6a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6313BB1C0034DABDB10DFE9D9849DEBFB8AF09350F50826EE914E7291D7748946CB60
                                                                                                                                                                                                              Function 00197100 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 102stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206), ref: 00197121
                                                                                                                                                                                                              • lstrcpyW.KERNEL32(?,HKCU\), ref: 00197172
                                                                                                                                                                                                              • _wcsnicmp.MSVCRT(?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,Software\Microsoft\Windows\CurrentVersion\Run), ref: 001971A8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _wcsnicmplstrcpymemset
                                                                                                                                                                                                              • String ID: %S%S%S$%s.%S%S$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
                                                                                                                                                                                                              • API String ID: 1531173107-4065158899
                                                                                                                                                                                                              • Opcode ID: 92ca29d35906ed34dbdede1297ccca9e8ea0b28830db807dcd4507275357108b
                                                                                                                                                                                                              • Instruction ID: cd5325a57b836826110aa938c0d8b777f7eab0683a7c962529a488a3e4d349b0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 92ca29d35906ed34dbdede1297ccca9e8ea0b28830db807dcd4507275357108b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E731E27AAA53147BCF10DF44AC46EEB33ADAF69751F000255FD05A2282E770AA9087B5
                                                                                                                                                                                                              Function 00196940 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 72stringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 001919F0: wcsrchr.MSVCRT(?,0000005C,?,00196965,?,?,?), ref: 001919F9
                                                                                                                                                                                                                • Part of subcall function 00197700: memset.MSVCRT(?,00000000,000001FF), ref: 0019771E
                                                                                                                                                                                                                • Part of subcall function 00197700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00197738
                                                                                                                                                                                                                • Part of subcall function 00197700: lstrlenA.KERNEL32(00000000), ref: 00197747
                                                                                                                                                                                                              • strstr.MSVCRT(001A6E90,.exe,?,?,?,?), ref: 001969A8
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(001A6D88,001DAC50,?,?,?,?,?,?), ref: 001969BE
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(001A6E90,00000080,?,?,?,?,?,?), ref: 001969D2
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(001A6E90,?,?,?,?,?,?), ref: 001969DD
                                                                                                                                                                                                              • MoveFileExA.KERNEL32(001A6D88,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT),?,?,?,?,?,?), ref: 001969EC
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT ref: 0019A335
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT ref: 0019A34F
                                                                                                                                                                                                                • Part of subcall function 0019A310: memset.MSVCRT(?,00000000,000003FF), ref: 0019A369
                                                                                                                                                                                                                • Part of subcall function 0019A310: _vsnprintf.MSVCRT(?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A382
                                                                                                                                                                                                                • Part of subcall function 0019A310: sprintf.MSVCRT(00000000,001A13EC,?,?,000003FE,001A0A8E,000001FE,?,00000000,000003FF), ref: 0019A39A
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s,blk,?,?,000001FE,001A0A8E), ref: 0019A3AD
                                                                                                                                                                                                                • Part of subcall function 0019A310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB,%s.%s), ref: 0019A3CC
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,001974EB), ref: 0019A3DB
                                                                                                                                                                                                                • Part of subcall function 0019A310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 0019A3EC
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A3FB
                                                                                                                                                                                                                • Part of subcall function 0019A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0019A404
                                                                                                                                                                                                                • Part of subcall function 0019A310: EnterCriticalSection.KERNEL32(001DAC34,?,?,00000000), ref: 0019A436
                                                                                                                                                                                                                • Part of subcall function 0019A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0019A452
                                                                                                                                                                                                                • Part of subcall function 0019A310: LeaveCriticalSection.KERNEL32(001DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0019A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • autorun.inf, xrefs: 00196970
                                                                                                                                                                                                              • pdef, xrefs: 00196986
                                                                                                                                                                                                              • %s.Blocked "%S" from creating "%S", xrefs: 00196A24
                                                                                                                                                                                                              • .exe, xrefs: 0019699C
                                                                                                                                                                                                              • %s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!, xrefs: 00196A06
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Filememset$CriticalSection_snprintfsprintf$AttributesCreateDeleteEnterLeaveMove_vsnprintflstrcmpstrstrwcsrchr
                                                                                                                                                                                                              • String ID: %s.Blocked "%S" from creating "%S"$%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!$.exe$autorun.inf$pdef
                                                                                                                                                                                                              • API String ID: 2285763329-814828592
                                                                                                                                                                                                              • Opcode ID: 7adb276a40bc9d7abd301b09a06a6a724581fb4dc2c73a03cd3d1fcb5567569f
                                                                                                                                                                                                              • Instruction ID: 5cca0ceeaf25512ba410a890f8440b96541ac451a4f83c61a2e826b0d9e24047
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7adb276a40bc9d7abd301b09a06a6a724581fb4dc2c73a03cd3d1fcb5567569f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6311867EBC031032DE1066E56C47F9E36596F73BA6F484024F909F22C6EBD1E94581B2
                                                                                                                                                                                                              Function 00193C90 Relevance: 16.7, APIs: 11, Instructions: 227filepipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 00193DA4
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-001A7960,00000800,00000000,?,?,?,00000000,000000FF), ref: 00193DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 00193E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,001A7960,00000800,00000000,?), ref: 00193ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EF3
                                                                                                                                                                                                              • DisconnectNamedPipe.KERNEL32(?), ref: 00193F68
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(?), ref: 00193F7E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileNamedPipeRead$ConnectDisconnectMultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4113577031-0
                                                                                                                                                                                                              • Opcode ID: c14cc7a8183ce798e8f023ea5282fde55346b0a470a93f14e2ae8e8d32d4157b
                                                                                                                                                                                                              • Instruction ID: 0a5bfe99818473b94dad6db821c468f2f14cc9907ec5a674f3bf2eac850ceffa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c14cc7a8183ce798e8f023ea5282fde55346b0a470a93f14e2ae8e8d32d4157b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5391D2B5A04219EFDB14CF68D8C4FAA7BA8FB49314F044259E91687780D771EA81CFA1
                                                                                                                                                                                                              Function 00199080 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 114COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206), ref: 001990A0
                                                                                                                                                                                                                • Part of subcall function 0019A0F0: wcsrchr.MSVCRT(001DA710,0000005C,001DA710,?,0019A1D9,001DA710,0019196F,?,?,?,?,?,00000000,?,?,00000000), ref: 0019A0FA
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00199101
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememsetwcsrchr
                                                                                                                                                                                                              • String ID: %s.Blocked possible browser exploit pack call on URL '%s'$com$exe$firefox.exe$http$iexplore.exe$pdef$pif$scr
                                                                                                                                                                                                              • API String ID: 519477765-3787805686
                                                                                                                                                                                                              • Opcode ID: c4b63a32c8e50ec0e3ea43218161bcb95c4cf8beae46cd12e7f08ae510a978b5
                                                                                                                                                                                                              • Instruction ID: c9a6ce33d2f9cfe764fc721fe4d27246b219aab7f1fb89f22155b5de7c6fc45b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c4b63a32c8e50ec0e3ea43218161bcb95c4cf8beae46cd12e7f08ae510a978b5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F31F6B9E443057BDF20DB549C0AEA737ACAF25361F044269FC1496142F761DD54C7B2
                                                                                                                                                                                                              Function 0019B160 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 69stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00196E9C,00000000,00000000,00000000,?,?,00196E9C), ref: 0019B178
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00196E9C), ref: 0019B186
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00196E9C,?,?,00196E9C), ref: 0019B18F
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,,00000000,00196E9C,00000000,?,?,00196E9C), ref: 0019B19F
                                                                                                                                                                                                              • strstr.MSVCRT(-00000004,001A19DC,?,?,?,00196E9C), ref: 0019B1B6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00196E9C), ref: 0019B1C3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00196E9C), ref: 0019B1D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00196E9C), ref: 0019B1DC
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00196E9C), ref: 0019B1E5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,00196E9C), ref: 0019B1F8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Allocstrstr$Freelstrcpyn
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1314289781-2344752452
                                                                                                                                                                                                              • Opcode ID: 8a9b12bf13ab42f9d2c08caed10fe68cffa4d6861fee806dccd8dafd8dc12f81
                                                                                                                                                                                                              • Instruction ID: 64dc90a96b1aab3a10654295c9bcc92538867b61d1f04ba9830e7ee13935d661
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8a9b12bf13ab42f9d2c08caed10fe68cffa4d6861fee806dccd8dafd8dc12f81
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A511E976A423247BD710ABB9AC85FAB77ACDF56711F404015FA04E3241DB75AD4087B0
                                                                                                                                                                                                              Function 0019AC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0019AC1A
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0019AC3E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019AC44
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0019AC5E
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0019AC79
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(POST,00000000), ref: 0019AC85
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019AC99
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019ACB2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 770645459-1814004025
                                                                                                                                                                                                              • Opcode ID: 5b3a77d1ef89fc3df4a2ba33c04d0b95b47c0c1edccaed880372eadf6d4aa43c
                                                                                                                                                                                                              • Instruction ID: ff15a05ab87396791a40ab4feb90eb8282096869d277016d3a51c0132b4ee58e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b3a77d1ef89fc3df4a2ba33c04d0b95b47c0c1edccaed880372eadf6d4aa43c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E21903A601214BBDB20DB69AC88FAB7B7CEF86760F504145FA04E6640D7319D44C7E1
                                                                                                                                                                                                              Function 0019A690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79processCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206), ref: 0019A6AF
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000616,?,00000000,00000206), ref: 0019A6CA
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000000), ref: 0019A6DF
                                                                                                                                                                                                              • PathAppendW.SHLWAPI(?,Internet Explorer\iexplore.exe), ref: 0019A6F9
                                                                                                                                                                                                              • _snwprintf.MSVCRT(?,00000617,"%s" %S,?,?), ref: 0019A71B
                                                                                                                                                                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 0019A77F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Pathmemset$AppendCreateFolderProcessSpecial_snwprintf
                                                                                                                                                                                                              • String ID: "%s" %S$D$Internet Explorer\iexplore.exe
                                                                                                                                                                                                              • API String ID: 1165436438-694066683
                                                                                                                                                                                                              • Opcode ID: b18a44e24e5b7bcf89b5639528c3a0a20771ba9dfb9efb9a508a4f777d304552
                                                                                                                                                                                                              • Instruction ID: a183badaed87cc6d6626215eaa834a405e111caf95e053dfe971251eb8411491
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b18a44e24e5b7bcf89b5639528c3a0a20771ba9dfb9efb9a508a4f777d304552
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E21AD75A40308BAEB24DBE0CC47FEE7378AF58B01F144584F7096A1C5EBB59A448B99
                                                                                                                                                                                                              Function 00199430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00199300: inet_addr.WS2_32(0019226E), ref: 00199308
                                                                                                                                                                                                                • Part of subcall function 00199300: gethostbyname.WS2_32(0019226E), ref: 00199313
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00199467
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00199490
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 001994BD
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 001994C1
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000002,00000011), ref: 001994F6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00199511
                                                                                                                                                                                                              • sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 0019953C
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 00199549
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00199559
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 00199564
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2400900511-0
                                                                                                                                                                                                              • Opcode ID: c48fb95db1b4c4b149972080c5403e54dadcf7bc95abd128d04bcf479b02cf8b
                                                                                                                                                                                                              • Instruction ID: 5684d588432374f564484bafea252ef817b2f11d98bc78bd794a326b52753682
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c48fb95db1b4c4b149972080c5403e54dadcf7bc95abd128d04bcf479b02cf8b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 30314B76900224ABDF21ABFC8946BAEB2999F99304F120539F915E7181D7709D01CBA2
                                                                                                                                                                                                              Function 0019ACD0 Relevance: 15.1, APIs: 10, Instructions: 107memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,?), ref: 0019ACF5
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0019AD0A
                                                                                                                                                                                                              • InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0019AD2B
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0019AD31
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0019AD4F
                                                                                                                                                                                                              • InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0019AD63
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 0019AD80
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0019AD93
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000000), ref: 0019ADB3
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0019ADE6
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocInternetOptionQuery$??2@ByteCharErrorFreeLastMultiWidelstrcpymemset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3155763378-0
                                                                                                                                                                                                              • Opcode ID: 44bf66bedab0af28d68cf6382799a7bf3fcf4a524249ad1435281b280d9d2fb5
                                                                                                                                                                                                              • Instruction ID: a5b55c3d0b6730e7b27dee534a462faba292ca7ac0013f91d432e9a21f20af73
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44bf66bedab0af28d68cf6382799a7bf3fcf4a524249ad1435281b280d9d2fb5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EC319479900314BBDB20DFA5CC85FAB7BB8EF8A751F504145FA1497680D770AD84CBA1
                                                                                                                                                                                                              Function 00199330 Relevance: 15.1, APIs: 10, Instructions: 81networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00199300: inet_addr.WS2_32(0019226E), ref: 00199308
                                                                                                                                                                                                                • Part of subcall function 00199300: gethostbyname.WS2_32(0019226E), ref: 00199313
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 0019935D
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 0019936F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00199373
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000000), ref: 001993A6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 001993C1
                                                                                                                                                                                                              • connect.WS2_32(?,?,00000010), ref: 001993DE
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 001993EB
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 001993F8
                                                                                                                                                                                                              • Sleep.KERNEL32(0000004B,?), ref: 00199405
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00199407
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleep$closesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1090714710-0
                                                                                                                                                                                                              • Opcode ID: e1e3a446b1fc1b952ba639d79e2db933397f413f0ed490f9203556f99dd17a0f
                                                                                                                                                                                                              • Instruction ID: 6a7749cd8514da3624e560179ae2809b4501f603367b64fe27b60d22ff64863a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e1e3a446b1fc1b952ba639d79e2db933397f413f0ed490f9203556f99dd17a0f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08210672900224ABDB21FFB89D45B8EB3A9EB98300F024619E908E7181D7709E41CBA1
                                                                                                                                                                                                              Function 0019FC90 Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 57stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0019FCB0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(30e44aa1), ref: 0019FCBD
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,%0x.exe,00000000,30e44aa1,00000000), ref: 0019FCE0
                                                                                                                                                                                                              • lstrcpyW.KERNEL32(001DB9A0,001DADA0), ref: 0019FCF2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DBDB0,RECYCLED), ref: 0019FD08
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DBEB4,?), ref: 0019FD16
                                                                                                                                                                                                                • Part of subcall function 0019F9E0: memset.MSVCRT(?,00000000,000001FF), ref: 0019F9FF
                                                                                                                                                                                                                • Part of subcall function 0019F9E0: GetLogicalDriveStringsA.KERNEL32(000001FF,00000000), ref: 0019FA22
                                                                                                                                                                                                                • Part of subcall function 0019F9E0: lstrcatA.KERNEL32(00000000,001A3040), ref: 0019FA5C
                                                                                                                                                                                                                • Part of subcall function 0019FB60: RegisterClassExA.USER32(?), ref: 0019FC05
                                                                                                                                                                                                                • Part of subcall function 0019FB60: CreateWindowExA.USER32(00000000,gdkWindowToplevelClass,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019FC20
                                                                                                                                                                                                                • Part of subcall function 0019FB60: RegisterDeviceNotificationA.USER32(00000000,00000020,00000000), ref: 0019FC30
                                                                                                                                                                                                                • Part of subcall function 0019FB60: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0019FC48
                                                                                                                                                                                                                • Part of subcall function 0019FB60: TranslateMessage.USER32(?), ref: 0019FC61
                                                                                                                                                                                                                • Part of subcall function 0019FB60: DispatchMessageA.USER32(?), ref: 0019FC67
                                                                                                                                                                                                                • Part of subcall function 0019FB60: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0019FC74
                                                                                                                                                                                                              • Sleep.KERNEL32(00003A98), ref: 0019FD61
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$lstrcpy$Registermemset$ClassCreateDeviceDispatchDriveLogicalNotificationSleepStringsTranslateWindow_snprintflstrcatlstrlen
                                                                                                                                                                                                              • String ID: %0x.exe$30e44aa1$RECYCLED
                                                                                                                                                                                                              • API String ID: 496236647-684435549
                                                                                                                                                                                                              • Opcode ID: 53f5874ded761792a287e2353510bd5009da45cc277fc66299be0bd6f4da10f1
                                                                                                                                                                                                              • Instruction ID: d60ba73b43e2ddc7aa5d4cf8cc792e4b49e726dc8735b105147375e01bb85020
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 53f5874ded761792a287e2353510bd5009da45cc277fc66299be0bd6f4da10f1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D11C6B5946318FFD700AFA4ACC2BA57768EB19704F41406FFA42A2591D7F02DC48F65
                                                                                                                                                                                                              Function 001989B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000034), ref: 001989C5
                                                                                                                                                                                                              • AcquireCredentialsHandleW.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 00198A32
                                                                                                                                                                                                              • QueryContextAttributesW.SECUR32(?,00000004,00000001), ref: 00198AC3
                                                                                                                                                                                                              • InitializeSecurityContextW.SECUR32(?,00000000,?,0008C11C,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00198A79
                                                                                                                                                                                                                • Part of subcall function 00198760: FreeContextBuffer.SECUR32(?), ref: 00198774
                                                                                                                                                                                                                • Part of subcall function 00198790: InitializeSecurityContextW.SECUR32(?,?,?,0008C11C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 001988AE
                                                                                                                                                                                                              • DeleteSecurityContext.SECUR32(?), ref: 00198B17
                                                                                                                                                                                                              • FreeCredentialsHandle.SECUR32(?), ref: 00198B1E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Context$Security$CredentialsFreeHandleInitialize$AcquireAttributesBufferDeleteQuerymemset
                                                                                                                                                                                                              • String ID: $Microsoft Unified Security Protocol Provider
                                                                                                                                                                                                              • API String ID: 3657786480-3891800672
                                                                                                                                                                                                              • Opcode ID: 9ed0b05b58f8e4c9bc7dbf12b8a0151a0310021804a1dc93e0f2d8d5465f1204
                                                                                                                                                                                                              • Instruction ID: b3ce715ec27a12978ee3a82e0f2a233f42d4537c68bd13ee9f611240229f5a7a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9ed0b05b58f8e4c9bc7dbf12b8a0151a0310021804a1dc93e0f2d8d5465f1204
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 895107B1D00208ABDB20DF9ADC85AAFFBF8FF95700F10451AE515E7251E774AA458BA0
                                                                                                                                                                                                              Function 00191D10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FE), ref: 00191D31
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF,?,00000000,000003FE), ref: 00191D4B
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 00191D9B
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A13D8), ref: 00191DAB
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000400), ref: 00191DCA
                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000200,00000000,00000000), ref: 00191E0C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharMultiWidememset$lstrcmpstrstr
                                                                                                                                                                                                              • String ID: bdns$block
                                                                                                                                                                                                              • API String ID: 1883446694-4143068083
                                                                                                                                                                                                              • Opcode ID: 12a527c42848adea131a30e70b0e30212c2dca62dd27721ee2ead25e49b68e21
                                                                                                                                                                                                              • Instruction ID: 16f73ddefc60aae3c58d0c381d1e5df76befa28eb1944daa8eb9d130b4666c45
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12a527c42848adea131a30e70b0e30212c2dca62dd27721ee2ead25e49b68e21
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CB31D8B56403057BEF20DE549C0AFEB7368DF96721F004555FE14A62C1EBB09E50C6A1
                                                                                                                                                                                                              Function 00191000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,001DAC50), ref: 0019100D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,001DAA28), ref: 00191054
                                                                                                                                                                                                              • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00191062
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001A6D88,?), ref: 0019108B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001A6E90,?), ref: 00191093
                                                                                                                                                                                                                • Part of subcall function 00197700: memset.MSVCRT(?,00000000,000001FF), ref: 0019771E
                                                                                                                                                                                                                • Part of subcall function 00197700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00197738
                                                                                                                                                                                                                • Part of subcall function 00197700: lstrlenA.KERNEL32(00000000), ref: 00197747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: %s.%s$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 4105673886-2574534833
                                                                                                                                                                                                              • Opcode ID: 3c43d2dbb072e5703e8dabcb9e05b06c827e88667626813f210d830d9828d0b6
                                                                                                                                                                                                              • Instruction ID: 5c73349e2a0b0c5cfce884d50858ae5ed5f90c6fc202b58fb6147323df7bc290
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c43d2dbb072e5703e8dabcb9e05b06c827e88667626813f210d830d9828d0b6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C01A77A341211BBDB209BB9AD89EEB7B9CEF6A7A1F4C0025F608D2541D771D8C0C275
                                                                                                                                                                                                              Function 00199C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strtok.MSVCRT(?,001A29EC), ref: 00199C7C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 00199C9A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(001DB648,001A1335), ref: 00199CB3
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(001DB648,00000000,00000200), ref: 00199CC4
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,001A29EC), ref: 00199CDB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 00199CE8
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 00199D73
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 00199CF9
                                                                                                                                                                                                              • [Slowloris]: Finished flood on "%s", xrefs: 00199D45
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
                                                                                                                                                                                                              • String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
                                                                                                                                                                                                              • API String ID: 1726920797-1250431664
                                                                                                                                                                                                              • Opcode ID: cd2a350180319b49502b7438f5f4cea6a4f2cef22bc6965e53f898a1964f6d9a
                                                                                                                                                                                                              • Instruction ID: 02157dc5b55fd1f82f6bf4f4b05e843640cac52b39ebf773dae7d039fa37bf6d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cd2a350180319b49502b7438f5f4cea6a4f2cef22bc6965e53f898a1964f6d9a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E4213BB628A744BFD710ABE4BC8AF6B37DDE716716F400029F60996691C7B558808BA0
                                                                                                                                                                                                              Function 001A0BB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,GetAddrInfoW), ref: 001A0C14
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,send), ref: 001A0C26
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _stricmp
                                                                                                                                                                                                              • String ID: GetAddrInfoW$dnsapi.dll$nspr4.dll$send$wininet.dll
                                                                                                                                                                                                              • API String ID: 2884411883-3553644081
                                                                                                                                                                                                              • Opcode ID: ed3d30e344c9297dd8d0a421b9c73cb827ef3f90949a24b021c4b5b646e50e76
                                                                                                                                                                                                              • Instruction ID: 9b6ba31fd17e5e7f89e6c3c46e7f3c5aeb5412a71a63f2aff73450fd655877c9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ed3d30e344c9297dd8d0a421b9c73cb827ef3f90949a24b021c4b5b646e50e76
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1110D3FF8113011DE2252A97D01BAAA3484F3A7B2F050276FD1DD3245D796DA5192F2
                                                                                                                                                                                                              Function 0019C8C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,http.set,?,msn.int,?,001A57F4,?,001A57F0,?,speed,?,rs0,?,stats), ref: 0019C8DD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,http.set,?,msn.int,?,001A57F4,?,001A57F0,?,speed,?,rs0,?,stats), ref: 0019C8E5
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,001A2C78,?,?,http.set,?,msn.int,?,001A57F4,?,001A57F0,?,speed,?,rs0), ref: 0019C907
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?,?,?,http.set,?,msn.int,?,001A57F4,?,001A57F0,?,speed,?,rs0), ref: 0019C913
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,http.int,?,http.set,?,msn.int,?,001A57F4,?,001A57F0,?,speed,?,rs0,?,stats), ref: 0019C985
                                                                                                                                                                                                              • atoi.MSVCRT(?,?,?,http.set,?,msn.int,?,001A57F4,?,001A57F0,?,speed,?,rs0,?,stats), ref: 0019C99C
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 0019C9AF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: atoilstrcatlstrlen$lstrcmp
                                                                                                                                                                                                              • String ID: [HTTP]: Updated HTTP spread message to "%s"$http$msg
                                                                                                                                                                                                              • API String ID: 3861295430-3390247340
                                                                                                                                                                                                              • Opcode ID: dee39e5265726ded81ca58d22756d84e9c92edf289378604b1a8fcbcbefd2b89
                                                                                                                                                                                                              • Instruction ID: 99273b4bd91d4d0fede8d853f14d8ae72f8286a6542094db2b01031d2d58f85e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dee39e5265726ded81ca58d22756d84e9c92edf289378604b1a8fcbcbefd2b89
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8019675A0420CAFDF24DF64CC81EDAB378AF54304F51048AE58993042DB35FA86CFA1
                                                                                                                                                                                                              Function 00193DB8 Relevance: 12.1, APIs: 8, Instructions: 108fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-001A7960,00000800,00000000,?,?,?,00000000,000000FF), ref: 00193DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 00193E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,001A7960,00000800,00000000,?), ref: 00193ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EF3
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 00193F0D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF), ref: 00193F1D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 146293752-0
                                                                                                                                                                                                              • Opcode ID: dc4882f073b300ae3b9d4f6e0166f675560fac82859745acae308c7f28fb8d47
                                                                                                                                                                                                              • Instruction ID: 40878591f769a7379f6a576376b77ef53e99fe6b43cbc5032f455ec12833c505
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc4882f073b300ae3b9d4f6e0166f675560fac82859745acae308c7f28fb8d47
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 974182B4604219BFDB04CF68DCC8FAA7BA8FF4A308F404658E55587385C771EA51CBA1
                                                                                                                                                                                                              Function 00193DB6 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,-001A7960,00000800,00000000,?,?,?,00000000,000000FF), ref: 00193DFF
                                                                                                                                                                                                              • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 00193E3E
                                                                                                                                                                                                              • ReadFile.KERNEL32(?,001A7960,00000800,00000000,?), ref: 00193ED7
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EE3
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EEA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193EF3
                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 00193F0D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000000,000000FF), ref: 00193F1D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 146293752-0
                                                                                                                                                                                                              • Opcode ID: 674e8ef110fb4ab1b3ad1c1beab96a3cfc4afe41bc00cd6f94d88df0ace4e663
                                                                                                                                                                                                              • Instruction ID: 1d3dc26fa0ba4a00ad663184be5f2e3310d37aa3538b100f24c9565de83eb7a6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 674e8ef110fb4ab1b3ad1c1beab96a3cfc4afe41bc00cd6f94d88df0ace4e663
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 974182B4604219BFDB04CF68DCC8FAA7BA8FF49308F504658E55687385C771EA41CBA1
                                                                                                                                                                                                              Function 00197500 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 99stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019752B
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 00197547
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(?,000001FF,00000000,?), ref: 00197569
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,bdns), ref: 0019758B
                                                                                                                                                                                                              • StrStrIA.SHLWAPI(?,00000000), ref: 0019759F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 001975B9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintf_vsnprintflstrcmp
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 3897371274-741241040
                                                                                                                                                                                                              • Opcode ID: 74254c27fc2cd06bbdbfd64ab47f405e2d475852a0d57972313ddd2e79ba0b35
                                                                                                                                                                                                              • Instruction ID: fe13fd8b9c85f55751c5d99d01cec16bdbcf610f222f45b9a6b694afa89b4e5b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 74254c27fc2cd06bbdbfd64ab47f405e2d475852a0d57972313ddd2e79ba0b35
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A421A0767042256BEF209EA9AC89FAB776CEF45754F440569BD09D3181EB30DE0086E0
                                                                                                                                                                                                              Function 00198670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103C), ref: 00198688
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 001986AE
                                                                                                                                                                                                              • inet_ntoa.WS2_32(?), ref: 001986F7
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00198704
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00198713
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00198640,00000000,00000000,00000000), ref: 00198734
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019873B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 30336511-0
                                                                                                                                                                                                              • Opcode ID: 36cee85dda83350b6de8a7e757b891519100385ee371fddbd6000525c0516d5d
                                                                                                                                                                                                              • Instruction ID: f6118f3e0a72e30698512fdc62be157fb6aa607590bac16a06d58200dc1509ca
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 36cee85dda83350b6de8a7e757b891519100385ee371fddbd6000525c0516d5d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 67213A79601700ABD7209FB4DD0ABE777A8AF09740F044919F55DCB2D0DBB0E580CB55
                                                                                                                                                                                                              Function 00197790 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 69stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 001977AE
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF,?,00000000,00000103), ref: 001977C8
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,off), ref: 001977F0
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,state_%s,?), ref: 0019780D
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00197822
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00197858
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlenmemset$_snprintflstrcpy
                                                                                                                                                                                                              • String ID: off$state_%s
                                                                                                                                                                                                              • API String ID: 1009457118-628336787
                                                                                                                                                                                                              • Opcode ID: 57aff660d05b973c7a259441b87bb8a5cb8200f995e06da9ad37bffb373d94d5
                                                                                                                                                                                                              • Instruction ID: 00703ba5faf3d510a0dc56463a4c7e27b22aae6e0b9afcc5bb7e318edf91d2d3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 57aff660d05b973c7a259441b87bb8a5cb8200f995e06da9ad37bffb373d94d5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8311E6B994125877DB21E754CD46FEA336C9F99700F0041D4FB48671C2E7F06B848BA1
                                                                                                                                                                                                              Function 00195820 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 171sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000007FF,00000016,001A6D28), ref: 00195844
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 001958B9
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 00195970
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00195A05
                                                                                                                                                                                                                • Part of subcall function 001949F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,001973CC,001C7C98,00000000,00000000,00000010,00000000), ref: 00194A10
                                                                                                                                                                                                                • Part of subcall function 001949F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00194A77
                                                                                                                                                                                                              • Sleep.KERNEL32(00000001), ref: 001959F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CompareExchangeInterlockedMutexObjectReleaseSingleSleepWaitmemset
                                                                                                                                                                                                              • String ID: STFU
                                                                                                                                                                                                              • API String ID: 1355865062-778810564
                                                                                                                                                                                                              • Opcode ID: 60297267255c6c5ae43301663b7daca513f470ed4074c5df71b55b13aa38b4f9
                                                                                                                                                                                                              • Instruction ID: 5db0323f34031f188261946fd7640d750ae112249b08a2d1016d7762633f4135
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60297267255c6c5ae43301663b7daca513f470ed4074c5df71b55b13aa38b4f9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D519370E00215ABDB14DFA9DC45FAE77F9EB84710F148169F945E7280DB749E81CB90
                                                                                                                                                                                                              Function 00193440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 136COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • printf.MSVCRT(block_size: %d,?,001C7A80,?), ref: 001934A0
                                                                                                                                                                                                              • printf.MSVCRT(ngr->blocksize: %d,?,block_size: %d,?,001C7A80,?), ref: 001934AD
                                                                                                                                                                                                              • printf.MSVCRT(Done frst,?,?,?,?,001C7A80,?), ref: 001934CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: printf
                                                                                                                                                                                                              • String ID: Done frst$block_size: %d$ngr->blocksize: %d
                                                                                                                                                                                                              • API String ID: 3524737521-1816125109
                                                                                                                                                                                                              • Opcode ID: fcf1ab0bf3732fd0f7f8b37cbaeea4356c24da80db58abe90452d7b16a971f26
                                                                                                                                                                                                              • Instruction ID: 9f702fb3c5c1ce62cf58202371e6b2168be7e8d3bd7ccf9a588a458d4d82bdf6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fcf1ab0bf3732fd0f7f8b37cbaeea4356c24da80db58abe90452d7b16a971f26
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B841E275A00204AFDF14DF68C846E9AB7A9EF99324F14C56DF9198B241E731EF01CB90
                                                                                                                                                                                                              Function 00192A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00192A44
                                                                                                                                                                                                                • Part of subcall function 00192460: GetProcessHeap.KERNEL32(?,001920DE,?), ref: 0019246C
                                                                                                                                                                                                                • Part of subcall function 00192460: HeapAlloc.KERNEL32(?,00000008,001920DE,?,001920DE,?), ref: 0019247E
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00192A8A
                                                                                                                                                                                                              • WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 00192A96
                                                                                                                                                                                                              • GetLastError.KERNEL32(00000002,00000001,00000006), ref: 00192A9B
                                                                                                                                                                                                                • Part of subcall function 001924A0: GetProcessHeap.KERNEL32(00000000,?,00192131,00000000), ref: 001924B4
                                                                                                                                                                                                                • Part of subcall function 001924A0: HeapFree.KERNEL32(?,00000000,00192131,00000000,?,00192131,00000000), ref: 001924C3
                                                                                                                                                                                                              • inet_ntoa.WS2_32(00000002), ref: 00192AEE
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 00192AFC
                                                                                                                                                                                                              • Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 00192B0B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 268164981-0
                                                                                                                                                                                                              • Opcode ID: 0da56ab7e9cc83f0e9870c1b97a82c888270740948db0025ca246e33b144fc71
                                                                                                                                                                                                              • Instruction ID: bde49c81de32d3af5d84ee47ee046859e532433d6af0aa7504bccfe7887f8a1a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0da56ab7e9cc83f0e9870c1b97a82c888270740948db0025ca246e33b144fc71
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D641D271E00214BBCF20EFA8D881AAFB3F9EF55720F10456AE559EB341D732A941CB91
                                                                                                                                                                                                              Function 00197F90 Relevance: 10.6, APIs: 7, Instructions: 131networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 00197FD4
                                                                                                                                                                                                              • send.WS2_32(?,?,?,00000000), ref: 00197FFB
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,00000000,?), ref: 00198004
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,00000000,00000001,?), ref: 0019803D
                                                                                                                                                                                                              • select.WS2_32(00000000,?,00000000,00000000,?), ref: 00198081
                                                                                                                                                                                                              • recv.WS2_32(?,?,00001000,00000000), ref: 0019809A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: select$FreeLocalrecvsend
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1822081929-0
                                                                                                                                                                                                              • Opcode ID: 621c10d3a2dc3789bf23fa7deb2d6b177796a3c128e2e7ff066e8b802d88168b
                                                                                                                                                                                                              • Instruction ID: f97ef478b880961ebf07770749cbfdf236f4ec69f7b257c349bd4e458049698d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 621c10d3a2dc3789bf23fa7deb2d6b177796a3c128e2e7ff066e8b802d88168b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 844183716007049BD730DF59DC81BE6B3F8EB99710F00469EF5899B680D7F1A9C58B90
                                                                                                                                                                                                              Function 00196E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00192460: GetProcessHeap.KERNEL32(?,001920DE,?), ref: 0019246C
                                                                                                                                                                                                                • Part of subcall function 00192460: HeapAlloc.KERNEL32(?,00000008,001920DE,?,001920DE,?), ref: 0019247E
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0019AFBD
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0019AFCB
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: memset.MSVCRT(?,00000000,000003FF), ref: 0019AFE8
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF), ref: 0019B002
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: lstrlenA.KERNEL32(?), ref: 0019B013
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: sscanf.MSVCRT(00000000,POST /%1023s,00000000,00000000,?,00000000), ref: 0019B02A
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: strtok.MSVCRT(00000000,001A2B84), ref: 0019B041
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: _memicmp.MSVCRT(00000000,Host: ,00000006), ref: 0019B05B
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: strtok.MSVCRT(00000000,001A2B84), ref: 0019B06E
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: lstrlenA.KERNEL32(00000000), ref: 0019B09B
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: lstrlenA.KERNEL32(00000000), ref: 0019B0AD
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: lstrlenA.KERNEL32(00000000), ref: 0019B0BB
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: lstrlenA.KERNEL32(00000000), ref: 0019B0C6
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: HeapAlloc.KERNEL32(?,00000000,?), ref: 0019B0D5
                                                                                                                                                                                                                • Part of subcall function 0019AFA0: _memicmp.MSVCRT(00000000,HTTP,00000004), ref: 0019B0EB
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A19DC,?,?,?,?), ref: 00196EBC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 00196EC9
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?), ref: 00196EE7
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?), ref: 00196F1A
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?,?,?), ref: 00196F2C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?), ref: 00196F3C
                                                                                                                                                                                                                • Part of subcall function 0019B160: lstrlenA.KERNEL32(00196E9C,00000000,00000000,00000000,?,?,00196E9C), ref: 0019B178
                                                                                                                                                                                                                • Part of subcall function 0019B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00196E9C), ref: 0019B186
                                                                                                                                                                                                                • Part of subcall function 0019B160: lstrlenA.KERNEL32(00196E9C,?,?,00196E9C), ref: 0019B18F
                                                                                                                                                                                                                • Part of subcall function 0019B160: strstr.MSVCRT(00000000,,00000000,00196E9C,00000000,?,?,00196E9C), ref: 0019B19F
                                                                                                                                                                                                                • Part of subcall function 0019B160: strstr.MSVCRT(-00000004,001A19DC,?,?,?,00196E9C), ref: 0019B1B6
                                                                                                                                                                                                                • Part of subcall function 0019B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00196E9C), ref: 0019B1C3
                                                                                                                                                                                                                • Part of subcall function 0019B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00196E9C), ref: 0019B1D2
                                                                                                                                                                                                                • Part of subcall function 0019B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00196E9C), ref: 0019B1DC
                                                                                                                                                                                                                • Part of subcall function 0019B160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00196E9C), ref: 0019B1E5
                                                                                                                                                                                                                • Part of subcall function 0019B160: HeapFree.KERNEL32(?,00000000,00000000,?,?,?,00196E9C), ref: 0019B1F8
                                                                                                                                                                                                                • Part of subcall function 001A01E0: memset.MSVCRT(?,00000000,000001FF,00000000,00000000,00000000), ref: 001A0202
                                                                                                                                                                                                                • Part of subcall function 001A01E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 001A0213
                                                                                                                                                                                                                • Part of subcall function 001A01E0: EnterCriticalSection.KERNEL32(001DB4E4), ref: 001A0223
                                                                                                                                                                                                                • Part of subcall function 001A01E0: strstr.MSVCRT(00000000,001A19DC), ref: 001A0243
                                                                                                                                                                                                                • Part of subcall function 001A01E0: lstrlenA.KERNEL32(00000000), ref: 001A0254
                                                                                                                                                                                                                • Part of subcall function 001A01E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 001A025F
                                                                                                                                                                                                                • Part of subcall function 001A01E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 001A0272
                                                                                                                                                                                                                • Part of subcall function 001A01E0: strstr.MSVCRT(00000000,), ref: 001A0281
                                                                                                                                                                                                                • Part of subcall function 001A01E0: _snprintf.MSVCRT(00000000,000001FF,%s=,001A32E4), ref: 001A02C8
                                                                                                                                                                                                                • Part of subcall function 001A01E0: strstr.MSVCRT(?,00000000), ref: 001A02EF
                                                                                                                                                                                                                • Part of subcall function 001A01E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 001A03E4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 836748388-1814004025
                                                                                                                                                                                                              • Opcode ID: ae959f4674f4ecdb65653b1d046095d274962d2b8c686cb76e0ab7f42ca19c51
                                                                                                                                                                                                              • Instruction ID: 2d671badb10d910ee3114618269223f73a7c5e192842e616982c14bb3b0fac6f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae959f4674f4ecdb65653b1d046095d274962d2b8c686cb76e0ab7f42ca19c51
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15319079A01208BBDF11DFA5EC85EAB77ACEF85700F544029F90897201DB35EE5087B2
                                                                                                                                                                                                              Function 0019D110 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 98stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF), ref: 0019D131
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,332), ref: 0019D145
                                                                                                                                                                                                              • strchr.MSVCRT(?,00000021), ref: 0019D162
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,?,000001FF), ref: 0019D18C
                                                                                                                                                                                                              • lstrlenA.KERNEL32 ref: 0019D198
                                                                                                                                                                                                              • memmove.MSVCRT(?,?,00000000), ref: 0019D1A4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpynlstrlenmemmovememsetstrchr
                                                                                                                                                                                                              • String ID: 332
                                                                                                                                                                                                              • API String ID: 3300951897-3855660651
                                                                                                                                                                                                              • Opcode ID: 0ecf0e062d5c0e4313926d7fbb0742173fd5e68495865daf0c3bd5eb43ba0c47
                                                                                                                                                                                                              • Instruction ID: 05c754b6755fc56aa7d1aff85fdd18b5c1cd3aedbbd7451abeeb69ffe457e679
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0ecf0e062d5c0e4313926d7fbb0742173fd5e68495865daf0c3bd5eb43ba0c47
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7431F4B6A002167BEB209B68DCC9FA7776CEF55740F044164F80997242E730ED05CBB1
                                                                                                                                                                                                              Function 00197610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?), ref: 00197640
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 0019765C
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(?,000001FF,00000000,00191732,?), ref: 0019767E
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,bdns,?,?), ref: 001976A0
                                                                                                                                                                                                              • StrStrIA.SHLWAPI(?,00000000,?,?), ref: 001976B4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf_vsnprintflstrcmplstrlen
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 4220314296-741241040
                                                                                                                                                                                                              • Opcode ID: c135dcdc3886e295001502c798bb28753d8b5757eb6c63aec1d21c00c436f6fa
                                                                                                                                                                                                              • Instruction ID: b2b05a938cd82e508c3fb9ae023964021430cdc964abee41ae7f46d182445cf0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c135dcdc3886e295001502c798bb28753d8b5757eb6c63aec1d21c00c436f6fa
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C621D376A042196BEF209EA8EC85FE77368EF49714F440569FD18D7141E770D90087E0
                                                                                                                                                                                                              Function 00193B90 Relevance: 10.6, APIs: 7, Instructions: 82pipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00193BD8
                                                                                                                                                                                                              • CreateNamedPipeA.KERNEL32(?,40000001,00000000,000000FF,00010000,00010000,00000000,00000000), ref: 00193C0F
                                                                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000,?), ref: 00193C25
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193C2F
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00193C46
                                                                                                                                                                                                              • SetEvent.KERNEL32(00000000), ref: 00193C56
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateErrorEventLastNamedPipe$Connect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3507186782-0
                                                                                                                                                                                                              • Opcode ID: f2f416b5c07a26c7aa75c4eba5a4865348c44699d226704217b41278c573e8bc
                                                                                                                                                                                                              • Instruction ID: c8498f5676dee19b1c6d330d5f821515f7ed03897faf079b5875aabd40157283
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2f416b5c07a26c7aa75c4eba5a4865348c44699d226704217b41278c573e8bc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9021C576344206BFEB208F74DCC4B99B7A4EF45751F208526FA2DDA580D7B1E9818B50
                                                                                                                                                                                                              Function 0019F2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00193810: GetProcessHeap.KERNEL32(00000000,00000000,?,00194046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00193819
                                                                                                                                                                                                                • Part of subcall function 00193810: HeapAlloc.KERNEL32(00000000,?,00194046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00193820
                                                                                                                                                                                                              • sprintf.MSVCRT(00000000,\\.\%c:), ref: 0019F2E9
                                                                                                                                                                                                              • CreateFileA.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000000,00000000), ref: 0019F2FA
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 0019F323
                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,002D1400,001A09A7,0000000C,?,00000400,00000000,00000000), ref: 0019F352
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019F35B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocCloseControlCreateDeviceFileHandleProcessmemsetsprintf
                                                                                                                                                                                                              • String ID: \\.\%c:
                                                                                                                                                                                                              • API String ID: 2995886503-1260769427
                                                                                                                                                                                                              • Opcode ID: 39f25dc22db404df293f2ef61fe5fc952893d7f29acf718251ed7d67f1e593e0
                                                                                                                                                                                                              • Instruction ID: b5b8537452373bbc040ec751ae8bfd7b3b76a834d4914efbc8a320f141afa3ca
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39f25dc22db404df293f2ef61fe5fc952893d7f29acf718251ed7d67f1e593e0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E2162F19402187FEB10DFA89C85EBEB7BCEB45754F0045B9FA18A6181E7B40F8586A1
                                                                                                                                                                                                              Function 001981C0 Relevance: 10.6, APIs: 7, Instructions: 61networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 001981E3
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 001981F9
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0019820F
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 0019821A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Startupclosesocketioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3235567692-0
                                                                                                                                                                                                              • Opcode ID: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
                                                                                                                                                                                                              • Instruction ID: 1092487b7581ae6808613f98e9e2857019546a60c2089bbf6e99a51d3b931849
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A01F57564021879EA21E6B49C07FFE725CCF1B720F0006A4FB18AA1C1EBF25A559396
                                                                                                                                                                                                              Function 0019A64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0019E750,00000000,00000000,00000000), ref: 0019A659
                                                                                                                                                                                                              • MessageBoxA.USER32(00000000,This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!,ngrBot Error,00000030), ref: 0019A66F
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0019A678
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0019A680
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 0019A666
                                                                                                                                                                                                              • ngrBot Error, xrefs: 0019A661
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateExitMessageObjectProcessSingleThreadWait
                                                                                                                                                                                                              • String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
                                                                                                                                                                                                              • API String ID: 2697768853-1169653777
                                                                                                                                                                                                              • Opcode ID: 49780b24d353d35a30d522c50c9079c093c8562b616c784f2298e4c98ba82a79
                                                                                                                                                                                                              • Instruction ID: 816e7408a4656fe07ed9488333c96048a7f01316d6700aef84a0b904966c5dd8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 49780b24d353d35a30d522c50c9079c093c8562b616c784f2298e4c98ba82a79
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 21E09E367C4351B7E63557A49E0FF4535545B07F52F210200F715BE8D08BE461C04759
                                                                                                                                                                                                              Function 00197330 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 60stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF), ref: 00197351
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00197369
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00197381
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(00000000,000001FE,001A0AAD,?), ref: 001973A3
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001973B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: %s_
                                                                                                                                                                                                              • API String ID: 3230270962-1040268105
                                                                                                                                                                                                              • Opcode ID: dc8ed9896449ba315fb42c91a971d86851c93a8d4f9444dcfe86fb96f59fe295
                                                                                                                                                                                                              • Instruction ID: a4a156e96af497fc51fbacfaad976b28aabb174e90e593c7749ed96d2f49d310
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc8ed9896449ba315fb42c91a971d86851c93a8d4f9444dcfe86fb96f59fe295
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99112B76A4031937EB20E6689C86FFB736CDF84B40F0405ACBD1897182E7B09E0487E1
                                                                                                                                                                                                              Function 001A02A9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 57memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,%s=,001A32E4), ref: 001A02C8
                                                                                                                                                                                                              • strstr.MSVCRT(?,00000000), ref: 001A02EF
                                                                                                                                                                                                              • atoi.MSVCRT(00000000,?,http,int), ref: 001A0322
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 001A0386
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A03E4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 001A03EE
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DB4E4), ref: 001A03FD
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 001A041F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$CriticalLeaveSection_snprintfatoilstrlenstrstr
                                                                                                                                                                                                              • String ID: %s=
                                                                                                                                                                                                              • API String ID: 1805118874-2646424381
                                                                                                                                                                                                              • Opcode ID: 8ddda403e3c12b80a91e156a1c13dfd188cdb17e610f6edf1aa6b6d46028de4e
                                                                                                                                                                                                              • Instruction ID: ea45c39f96d616650e009ddcc81d9a7bb8a72d0940d0500ceb0e8720036bd597
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8ddda403e3c12b80a91e156a1c13dfd188cdb17e610f6edf1aa6b6d46028de4e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D311E939A40309AFDF21C760CC81BBBB378FF9A304F144069E91953140D770AD418BA0
                                                                                                                                                                                                              Function 0019DD20 Relevance: 9.0, APIs: 6, Instructions: 36sleepthreadnetworkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CleanupCountCriticalExitInitializeSectionSleepThreadTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 544336047-0
                                                                                                                                                                                                              • Opcode ID: c71fa33e78d161fd272ea356b1ff8069d12b230e254f48654e35323ad265adfd
                                                                                                                                                                                                              • Instruction ID: c764bb96e326b1a14cc6e838f831b4f0c875c151b729c0413bc7064dc8259c32
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c71fa33e78d161fd272ea356b1ff8069d12b230e254f48654e35323ad265adfd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBF0E9B0504710ABDE207BF87F0A56E31905F22328F140701F625C2AF0EF3099808AE3
                                                                                                                                                                                                              Function 00194560 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s_%d,EDB88F28,?,00010000,EDB88320,00000000), ref: 001945D5
                                                                                                                                                                                                              • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00194BA5,?,?,?,00010000,EDB88320,00000000), ref: 001945FD
                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,?,00010000,EDB88320,00000000), ref: 00194636
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateMappingView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 1261873476-1933919280
                                                                                                                                                                                                              • Opcode ID: bade73710b1ebcfc9e924e5b982d1a142321619565c8cca431c2c8df69cef3e9
                                                                                                                                                                                                              • Instruction ID: da6fe2449fa20fec5666963cc2e57fa8c97357e2a6f234a7084c5c55ee461e94
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bade73710b1ebcfc9e924e5b982d1a142321619565c8cca431c2c8df69cef3e9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B061F4B16002029FD726CF18C881B76B7E5FF84304F18817CE6868B385D778A8A0DB80
                                                                                                                                                                                                              Function 0019E4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79sleepmemorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00199FF0: strtok.MSVCRT(?,?,0000002C), ref: 0019A013
                                                                                                                                                                                                                • Part of subcall function 00199FF0: strtok.MSVCRT(00000000,?), ref: 0019A04F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019E517
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,?,00000000), ref: 0019E525
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0019E54E
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0019E57A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strtok$FreeHeapSleep_memicmplstrlen
                                                                                                                                                                                                              • String ID: [Login]: %s
                                                                                                                                                                                                              • API String ID: 2470415281-2266835287
                                                                                                                                                                                                              • Opcode ID: b6ee54652f89a34920a196b732b22e7c126bf5b01deebd29bee57db5e9a2a850
                                                                                                                                                                                                              • Instruction ID: 96d59fb0b76cbd6357ee6c98b1047126256d212eacef6a8417e008060ac93983
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b6ee54652f89a34920a196b732b22e7c126bf5b01deebd29bee57db5e9a2a850
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0921C3B9600204BBEB20DB98DC82F6B77E8EF85744F154418F90587282F775ED40CBA1
                                                                                                                                                                                                              Function 00191C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 00191C6E
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00191CC6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00191CD9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$CloseFileModuleWrite
                                                                                                                                                                                                              • String ID: CreateFileW$kernel32.dll
                                                                                                                                                                                                              • API String ID: 2352564674-2113957990
                                                                                                                                                                                                              • Opcode ID: b2ca76ea9f03a8f4cd2a6943d4bd9125a5c95d53eadac42d0241579da6590aa2
                                                                                                                                                                                                              • Instruction ID: 5b086644281e19fbfb7fbb7980831710cbac4bd4056373adc1981de96a7748bb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b2ca76ea9f03a8f4cd2a6943d4bd9125a5c95d53eadac42d0241579da6590aa2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D20126B66402197FDB049FA8DC85FEB335DEB4A324F148618FA25972C0D3705D8443A0
                                                                                                                                                                                                              Function 001916F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strstr.MSVCRT(?,001A13D8), ref: 0019170E
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,block), ref: 00191754
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,001A13D8), ref: 00191764
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstr$lstrcmp
                                                                                                                                                                                                              • String ID: bdns$block
                                                                                                                                                                                                              • API String ID: 142677638-4143068083
                                                                                                                                                                                                              • Opcode ID: 0ffe7e0d7ecbcf633c4450902a4a13c7deb9d9bd1e033fb75c9e583135ac9fa5
                                                                                                                                                                                                              • Instruction ID: 731fa28ae82eaf8d85652726d10ffa1fa962cd68c2f7a33caf2e88a2df8e83ea
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0ffe7e0d7ecbcf633c4450902a4a13c7deb9d9bd1e033fb75c9e583135ac9fa5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D21C1BA64020A7B9F14DE88AC45DBF33ACEF9A721F048119FC0193281E770ED5086B1
                                                                                                                                                                                                              Function 00197E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103A), ref: 00197E2C
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00197E63
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00197E7A
                                                                                                                                                                                                              • connect.WS2_32(?,00000008,00000010), ref: 00197E8B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocLocalconnectioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3721573447-0
                                                                                                                                                                                                              • Opcode ID: dac0222eff4f69a975c2fc89199b67b92f31253760dd91f2afd654b3f44dff74
                                                                                                                                                                                                              • Instruction ID: 2a86c608e868135c6d7f1d1950e25e746da6d5275d9039466139719739004918
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dac0222eff4f69a975c2fc89199b67b92f31253760dd91f2afd654b3f44dff74
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7611E631A00304AFCB20DF69D809ED6B7A8EF49720F004699FA599B3D1D3B2A9948790
                                                                                                                                                                                                              Function 0019E770 Relevance: 7.6, APIs: 5, Instructions: 50registrystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0019E77C
                                                                                                                                                                                                              • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000012,?), ref: 0019E793
                                                                                                                                                                                                              • RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 0019E7B5
                                                                                                                                                                                                              • RegNotifyChangeKeyValue.ADVAPI32(?,00000000,00000004,00000000,00000000), ref: 0019E7C3
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0019E7D1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ChangeCloseNotifyOpenlstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2592630252-0
                                                                                                                                                                                                              • Opcode ID: ab00acf3df30246c2b4230aa44aa0579f93e94b8c54ac69b397d596f01d580b2
                                                                                                                                                                                                              • Instruction ID: b4cf99324f19917c3316b72b8ac9943310a5dd688b9d5e8925270152ee9ef825
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ab00acf3df30246c2b4230aa44aa0579f93e94b8c54ac69b397d596f01d580b2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B001DE75340344BFEB24CBA5DD85F9777ACEB89B50F108419BA4597680D671E8808BA4
                                                                                                                                                                                                              Function 00197700 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF), ref: 0019771E
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00197738
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 00197747
                                                                                                                                                                                                                • Part of subcall function 00194900: WaitForSingleObject.KERNEL32(00197495,000000FF,?,00000000,756F59EB,?,00197495), ref: 00194939
                                                                                                                                                                                                                • Part of subcall function 00194900: ReleaseMutex.KERNEL32(?,?,00197495), ref: 0019497C
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(00000000,001A1A30), ref: 0019777F
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexObjectReleaseSingleWait_snprintflstrcmplstrlenmemset
                                                                                                                                                                                                              • String ID: state_%s
                                                                                                                                                                                                              • API String ID: 1716770999-3670522127
                                                                                                                                                                                                              • Opcode ID: 2d770ecfcfd66b4c66a23d178d2965e9b2086bd1a5ee3577c79d7a0b00de666a
                                                                                                                                                                                                              • Instruction ID: be74fab78ea0ad324ea7e21b73d232cf1177b7447bd7140a8af8f6ce51b7d633
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d770ecfcfd66b4c66a23d178d2965e9b2086bd1a5ee3577c79d7a0b00de666a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC0126B9A503097ADB10E6B4DD0BFF973AC9B59700F0045D4BA18A2082F7B05A448AA0
                                                                                                                                                                                                              Function 001950F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s-comm,001C7AE8), ref: 0019510F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00195122
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0019512B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-comm
                                                                                                                                                                                                              • API String ID: 3057366584-1028030816
                                                                                                                                                                                                              • Opcode ID: d2fc2edcc1ee476af1e24150d0c2e11d69ebd0db38067862cbf6979c7a24eced
                                                                                                                                                                                                              • Instruction ID: 8dd88a35c1595699880ac4a0bd7ded896a862fdeadcd27b6d83e05287a3b22ea
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d2fc2edcc1ee476af1e24150d0c2e11d69ebd0db38067862cbf6979c7a24eced
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57210AB9A81214BBDB14DB51DC42FEB3339A7A4711F04065AF514B72D2EBB0DB94CBA0
                                                                                                                                                                                                              Function 00196D90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,00196C55,00000000), ref: 00196DA1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                                                                              • String ID: NtQueryInformationProcess$NtSetInformationProcess$ntdll.dll
                                                                                                                                                                                                              • API String ID: 4139908857-4148885600
                                                                                                                                                                                                              • Opcode ID: 13bbd319d6936da155467a7417ed3fc210bd683ae6e1a3f1d8860423387d09f7
                                                                                                                                                                                                              • Instruction ID: 34b552d38aac61b1511269bf210d1f9ac07e94e237692789317d91e4edc620ca
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 13bbd319d6936da155467a7417ed3fc210bd683ae6e1a3f1d8860423387d09f7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B01A7B67453583BEF2095999C45FEA739CCB87779F000152FE08E7280DBA19D0082E5
                                                                                                                                                                                                              Function 0019FAA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • DefWindowProcA.USER32(?,?,?,?), ref: 0019FAC0
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%c:\,?,?), ref: 0019FAF9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProcWindowsprintf
                                                                                                                                                                                                              • String ID: %c:\$[USB]: Infected %s
                                                                                                                                                                                                              • API String ID: 3179433310-2800184719
                                                                                                                                                                                                              • Opcode ID: 6302709b0e15adfff82fc63571bc68f152f65422a9cfe5751fc319e9e8f42a5d
                                                                                                                                                                                                              • Instruction ID: 68fba3dd3686ade605b25edc1735f706982a66d701a91f02e5e8224a5eeaa562
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6302709b0e15adfff82fc63571bc68f152f65422a9cfe5751fc319e9e8f42a5d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF119EB6500108ABCB20DF64DD92B7A73ADEB55704F04856DFA0AD2242EB31E9528B61
                                                                                                                                                                                                              Function 00195070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s-pid,001C7AE8), ref: 0019508F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 001950A2
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 001950AB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-pid
                                                                                                                                                                                                              • API String ID: 3057366584-2694366501
                                                                                                                                                                                                              • Opcode ID: ec1b1ab365d6e4c3f4b40b86efefa707287c9c0e9d27a6078b6058972439430a
                                                                                                                                                                                                              • Instruction ID: 5d46a39d3d63bee714281af46d057b90db72e9a0a915484f3d1fd2c37b4eb603
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec1b1ab365d6e4c3f4b40b86efefa707287c9c0e9d27a6078b6058972439430a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 73F027B5A4030477EF20E7B09D8BF9B325D9720711F540655F714B20C0EBF19AD88BA1
                                                                                                                                                                                                              Function 0019D760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00197700: memset.MSVCRT(?,00000000,000001FF), ref: 0019771E
                                                                                                                                                                                                                • Part of subcall function 00197700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00197738
                                                                                                                                                                                                                • Part of subcall function 00197700: lstrlenA.KERNEL32(00000000), ref: 00197747
                                                                                                                                                                                                              • Sleep.KERNEL32(00001388), ref: 0019D78A
                                                                                                                                                                                                              • Sleep.KERNEL32(00002710), ref: 0019D795
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0019D799
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Sleep$ExitProcess_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: bsod
                                                                                                                                                                                                              • API String ID: 706155222-1315366068
                                                                                                                                                                                                              • Opcode ID: 7041af9b24853c019d204bb74b41b80ec9c3be6b511ba30a8f0254668d3548bc
                                                                                                                                                                                                              • Instruction ID: f811c6a5d9b1375bf93b32f15d70fcc01c200201a4de0961517b6eb7b26afdd7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7041af9b24853c019d204bb74b41b80ec9c3be6b511ba30a8f0254668d3548bc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0D0A77698423073DA2623F92D0AF4B7830DF52F61F070210FD05AB9D097A029C185E6
                                                                                                                                                                                                              Function 0019E840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00197330: memset.MSVCRT(?,00000000,000001FF), ref: 00197351
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(?), ref: 00197369
                                                                                                                                                                                                                • Part of subcall function 00197330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00197381
                                                                                                                                                                                                                • Part of subcall function 00197330: _vsnprintf.MSVCRT(00000000,000001FE,001A0AAD,?), ref: 001973A3
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(00000000), ref: 001973B2
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 0019E861
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019E868
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: admin$isadmin
                                                                                                                                                                                                              • API String ID: 3136305548-1977506819
                                                                                                                                                                                                              • Opcode ID: 77221ce4b9d66de2eb3fc82bed42182ee35fcfa0994148d65c82f6eb9690ea0c
                                                                                                                                                                                                              • Instruction ID: e82323248fe74857145a993a9aac8fc5cb276757d3a70dd0850ecb90a9dced8a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77221ce4b9d66de2eb3fc82bed42182ee35fcfa0994148d65c82f6eb9690ea0c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1D012797D430076FA2023B06E0FF0931442B26F1BF604420FB00B95C9EBE0318049BA
                                                                                                                                                                                                              Function 00192880 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00192460: GetProcessHeap.KERNEL32(?,001920DE,?), ref: 0019246C
                                                                                                                                                                                                                • Part of subcall function 00192460: HeapAlloc.KERNEL32(?,00000008,001920DE,?,001920DE,?), ref: 0019247E
                                                                                                                                                                                                              • inet_addr.WS2_32(00000001), ref: 001928BE
                                                                                                                                                                                                              • DnsQuery_A.DNSAPI(00000001,00000001,00000008,00000000,00000001,00000000), ref: 00192939
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,00000001,00000001,?,00000000,00000001,00000006), ref: 0019294E
                                                                                                                                                                                                              • DnsFree.DNSAPI(00000001,00000001), ref: 001929D9
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeProcessQuery__stricmpinet_addr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3002912770-0
                                                                                                                                                                                                              • Opcode ID: 9f94ac7b6b82f9c2fe502dd79620afc0851f4b84c54f1ae7af82d4ebe4501922
                                                                                                                                                                                                              • Instruction ID: 2aabb86b588761cd9232d38d840588b0e78d4612758b658f172975b5a26d2b5e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9f94ac7b6b82f9c2fe502dd79620afc0851f4b84c54f1ae7af82d4ebe4501922
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3551C174A00204FFDB21DF58C881B6AB3B5FF9A708F244469E5899B385E771ED41CBA1
                                                                                                                                                                                                              Function 0019D530 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 121sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0019D5E4
                                                                                                                                                                                                                • Part of subcall function 00198F50: ApplyControlToken.SECUR32(?,?), ref: 00198FB5
                                                                                                                                                                                                                • Part of subcall function 00198F50: InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00198FF9
                                                                                                                                                                                                                • Part of subcall function 00198F50: DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00199025
                                                                                                                                                                                                                • Part of subcall function 00198F50: FreeCredentialsHandle.SECUR32(?), ref: 0019902F
                                                                                                                                                                                                              • Sleep.KERNEL32(0000000F), ref: 0019D659
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ContextSecuritySleep$ApplyControlCredentialsDeleteFreeHandleInitializeToken
                                                                                                                                                                                                              • String ID: %s:%d$cnc
                                                                                                                                                                                                              • API String ID: 3241915987-1903477246
                                                                                                                                                                                                              • Opcode ID: 548f795972d807959dbe0aa7f95a804db9799584764de0e3e3cb1ed123b1f462
                                                                                                                                                                                                              • Instruction ID: a781d2c242cca5a6cdfc64c8543fc322a1f77ee4b93df5e5ec80c51f3b852f72
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 548f795972d807959dbe0aa7f95a804db9799584764de0e3e3cb1ed123b1f462
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C941E4B6A00104EBDF10DBA8ECC19AEB7B9EB95714F554165F909E7302DB31EE40C7A1
                                                                                                                                                                                                              Function 00198F50 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ApplyControlToken.SECUR32(?,?), ref: 00198FB5
                                                                                                                                                                                                              • InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00198FF9
                                                                                                                                                                                                              • DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00199025
                                                                                                                                                                                                              • FreeCredentialsHandle.SECUR32(?), ref: 0019902F
                                                                                                                                                                                                                • Part of subcall function 00198760: FreeContextBuffer.SECUR32(?), ref: 00198774
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Context$FreeSecurity$ApplyBufferControlCredentialsDeleteHandleInitializeToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 362823901-0
                                                                                                                                                                                                              • Opcode ID: e95799457847112b208eced5b4e342e2ebda1f6ad26a44bdc37665d307c03872
                                                                                                                                                                                                              • Instruction ID: f44fdd6066712c610c35c163f9f04586009360bb16b9ac794e6715c6669c34d9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e95799457847112b208eced5b4e342e2ebda1f6ad26a44bdc37665d307c03872
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0A41B4B1C00209ABCF10DFAAC985AEEFBFCFF98304F14450EE515A3651D7B5A6458BA4
                                                                                                                                                                                                              Function 00194900 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00197495,000000FF,?,00000000,756F59EB,?,00197495), ref: 00194939
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,00197495), ref: 0019497C
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(-0000FFFF,?,00197495), ref: 001949A5
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(00197495,?,00197495), ref: 001949D1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexRelease$ObjectSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 257779224-0
                                                                                                                                                                                                              • Opcode ID: e93373a6b10ba988cfbbaac3c62d83bac536f5e5082677745037291f24178ebe
                                                                                                                                                                                                              • Instruction ID: 9b22b5e936e54697147c486a06749940a866b5b308e62b5196da49fe47e9e849
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e93373a6b10ba988cfbbaac3c62d83bac536f5e5082677745037291f24178ebe
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27212E312012069BDF20DF69E854BA777A9EF8536CF194526E998C7250E730DC52CBA1
                                                                                                                                                                                                              Function 001949F0 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,001973CC,001C7C98,00000000,00000000,00000010,00000000), ref: 00194A10
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00194A77
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,?,00000000), ref: 00194AA9
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,00000000), ref: 00194ABC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MutexRelease$ObjectSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 257779224-0
                                                                                                                                                                                                              • Opcode ID: 99fc58911da551b16ac198446f5edd4e8dd17b745487a55bec41bd83f2cedf8d
                                                                                                                                                                                                              • Instruction ID: 725f55d4780fca363feec4e911bb594cef8328a6232a5257a64ce5e7ea6977f5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99fc58911da551b16ac198446f5edd4e8dd17b745487a55bec41bd83f2cedf8d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F021B5727042055BDF10DF69EC80EAA73A9AF80758B19452AFC4AC7340EB30DD4387E8
                                                                                                                                                                                                              Function 001911C0 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206), ref: 001911E1
                                                                                                                                                                                                              • GetFileAttributesA.KERNEL32(?), ref: 00191201
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00191241
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00191261
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AttributesByteCharExitFileMultiThreadWidememset
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1389112251-0
                                                                                                                                                                                                              • Opcode ID: c73faa85eb6779935fa6f33a3ff111c41bb64a7adc9c4031932c3f616db96574
                                                                                                                                                                                                              • Instruction ID: 716421b6e0520ee90b0ec2136b3fa671a1a2e5c60eb6ae004f391e2ffad70d17
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c73faa85eb6779935fa6f33a3ff111c41bb64a7adc9c4031932c3f616db96574
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D3214976200219BFDB10DF54EC49FEB3778EB89711F044219FE1993281DB30A991CBA1
                                                                                                                                                                                                              Function 0019D6B0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 0019D6FD
                                                                                                                                                                                                              • RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0019D731
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0019D740
                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0019D753
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Close$CreateValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1009429713-0
                                                                                                                                                                                                              • Opcode ID: 29a1cb855c458276b5f1113d51e978c8c10d1f719070d8e879c030fcfd396465
                                                                                                                                                                                                              • Instruction ID: 3025c85284e772ab47f33eace0ed371f9ea6d26083a250d39935e1de62c27f10
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 29a1cb855c458276b5f1113d51e978c8c10d1f719070d8e879c030fcfd396465
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99213075740209BBDB14CF94DD46FBA7379EB88B44F104144FA05AB284E770FA4097A0
                                                                                                                                                                                                              Function 00197EF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeLocal$closesocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1824021853-0
                                                                                                                                                                                                              • Opcode ID: f47f5ecf8370e01a9f4c211ce00a12414353b172548c3806fce4da7f3017e0b5
                                                                                                                                                                                                              • Instruction ID: a063ff84ddc3242c87fcd8cd937fa324dc0296b1163be9743d9c53451c799fb5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f47f5ecf8370e01a9f4c211ce00a12414353b172548c3806fce4da7f3017e0b5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A6014F367052149FCB22DF59E88489AB3A9FF8E76575404BAF548DB350C731EC41CBA4
                                                                                                                                                                                                              Function 0019A800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: c7f398fce53cafa6c7b949aa0b979b1df37a66a7a9f134e3b9958399c425deaf
                                                                                                                                                                                                              • Instruction ID: e101b41a647b236716631abdc8b53cbd4050853d2d16f54a4ac95840934cf133
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7f398fce53cafa6c7b949aa0b979b1df37a66a7a9f134e3b9958399c425deaf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEF02D7A2003006BDB11A2649C86A9A735ADBD9762F040424FD0A87202FF79DD4541F3
                                                                                                                                                                                                              Function 0019A790 Relevance: 6.0, APIs: 4, Instructions: 44stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: f711fe983436df3b9fd4270a8edd97ad916f8beea9ff142eb62671092029358c
                                                                                                                                                                                                              • Instruction ID: 8cd6e4197a74c0450c2e9f5940381058d47ab24c7d6d3edc7c431ac30f6637b7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f711fe983436df3b9fd4270a8edd97ad916f8beea9ff142eb62671092029358c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CEF050775011116BCA3163A5EC87B8BB79CDF95761F040571FF059B212E72DAE4481F2
                                                                                                                                                                                                              Function 0019A080 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0019A0A2
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0019A0C0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019A0CB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019A0D8
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandle$CreateWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3602564925-0
                                                                                                                                                                                                              • Opcode ID: f09bb91d3557429ee7303accf21a59723dc2b6cfeb6c5115704ee8d4b50b6e22
                                                                                                                                                                                                              • Instruction ID: 9429eebed95a73092cde51cc1da0b5e2973a29d0ade597afcddfc279f8c6cb8a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f09bb91d3557429ee7303accf21a59723dc2b6cfeb6c5115704ee8d4b50b6e22
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D2F06275251214BBE7209BA8EC09F9A37A8EB49764F104244FE18D72C0D6716D4487E5
                                                                                                                                                                                                              Function 001A0880 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00194900: WaitForSingleObject.KERNEL32(00197495,000000FF,?,00000000,756F59EB,?,00197495), ref: 00194939
                                                                                                                                                                                                                • Part of subcall function 00194900: ReleaseMutex.KERNEL32(?,?,00197495), ref: 0019497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,00000000,%s.p10-> Message to %s hijacked!,msn), ref: 001A08B1
                                                                                                                                                                                                                • Part of subcall function 00197330: memset.MSVCRT(?,00000000,000001FF), ref: 00197351
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(?), ref: 00197369
                                                                                                                                                                                                                • Part of subcall function 00197330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00197381
                                                                                                                                                                                                                • Part of subcall function 00197330: _vsnprintf.MSVCRT(00000000,000001FE,001A0AAD,?), ref: 001973A3
                                                                                                                                                                                                                • Part of subcall function 00197330: lstrlenA.KERNEL32(00000000), ref: 001973B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$MutexObjectReleaseSingleWait_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 1310428588-4225137719
                                                                                                                                                                                                              • Opcode ID: ede21b88d09b7c13b818c03b7185423dea5c441506cd2f3d8a28ea7bf48516ca
                                                                                                                                                                                                              • Instruction ID: 69ae2bc6cefa555f65a48e77b28300553cee5adcf86889c53af089675e101f04
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ede21b88d09b7c13b818c03b7185423dea5c441506cd2f3d8a28ea7bf48516ca
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8EF02736B451283BDA206699AC07FEF774CDB43761F000191FD08E6241EBD54E0003F1
                                                                                                                                                                                                              Function 001A0820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00194900: WaitForSingleObject.KERNEL32(00197495,000000FF,?,00000000,756F59EB,?,00197495), ref: 00194939
                                                                                                                                                                                                                • Part of subcall function 00194900: ReleaseMutex.KERNEL32(?,?,00197495), ref: 0019497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,00192696), ref: 001A084B
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF), ref: 00197401
                                                                                                                                                                                                                • Part of subcall function 001973E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00197419
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 00197431
                                                                                                                                                                                                                • Part of subcall function 001973E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00197449
                                                                                                                                                                                                                • Part of subcall function 001973E0: _vsnprintf.MSVCRT(?,000001FE,001A0A8E,?), ref: 0019746B
                                                                                                                                                                                                                • Part of subcall function 001973E0: lstrlenA.KERNEL32(?), ref: 0019747A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 3682388603-4225137719
                                                                                                                                                                                                              • Opcode ID: ff23a3dd6ea890523efadab42a42eeaef9a92ef03baa9ee15ecfba74531abdff
                                                                                                                                                                                                              • Instruction ID: 9d256e214e8df54fc4df32c6c6b0743d27d64509fbd246b7f6cc3dfbc8f23470
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ff23a3dd6ea890523efadab42a42eeaef9a92ef03baa9ee15ecfba74531abdff
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24F0E576E951293BDA2076A8AC07FFB728CCF17B94F000591FC08E6281EBD55E1002E1
                                                                                                                                                                                                              Function 0019B990 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF,00000000), ref: 0019B9AF
                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(001DA6C8,?,?,00000000), ref: 0019B9BC
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,?,00000000,?,?,00000000), ref: 0019B9D1
                                                                                                                                                                                                                • Part of subcall function 00198B30: memset.MSVCRT(?,00000000,0000002C), ref: 00198B6E
                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(001DA6C8,?,?,?,?,?,00000000), ref: 0019B9F2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemset$EnterLeavewvsprintf
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2410102678-0
                                                                                                                                                                                                              • Opcode ID: d4ac03c48f42640a173dd22ea511085b1e25af1ad37f9e3ea9693ca9bd946381
                                                                                                                                                                                                              • Instruction ID: d19b3dedfbd4103c26dbc16994911d107bc9c26ee318a790910ecb0e60b07058
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d4ac03c48f42640a173dd22ea511085b1e25af1ad37f9e3ea9693ca9bd946381
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5F0BBBAD002187FC710EB64DC0AFEA7B6CEF45745F044195FF09E2240E770AA458BA5
                                                                                                                                                                                                              Function 0019E990 Relevance: 6.0, APIs: 4, Instructions: 31sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000DD20,00000000,00000000,00000000), ref: 0019E9BF
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0019E9C6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0019E9C9
                                                                                                                                                                                                              • Sleep.KERNEL32(0000EA60), ref: 0019E9D4
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleObjectSingleSleepThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 422747524-0
                                                                                                                                                                                                              • Opcode ID: a1c67422eea1c682cbc5274180496e12805331740660a8194134f4f0d3991082
                                                                                                                                                                                                              • Instruction ID: 47f2bfbb3859b2eb4dccaf20bc4961ede9ee4ff15dfb826e9897cfbe512deb51
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1c67422eea1c682cbc5274180496e12805331740660a8194134f4f0d3991082
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F0F09B31341311FBE7305759ED46F9B7398EB47765F280116F314A65E093B06DC186AA
                                                                                                                                                                                                              Function 0019BA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000007FF), ref: 0019BA1E
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,00000000,00000000), ref: 0019BA42
                                                                                                                                                                                                                • Part of subcall function 0019B990: memset.MSVCRT(?,00000000,000003FF,00000000), ref: 0019B9AF
                                                                                                                                                                                                                • Part of subcall function 0019B990: EnterCriticalSection.KERNEL32(001DA6C8,?,?,00000000), ref: 0019B9BC
                                                                                                                                                                                                                • Part of subcall function 0019B990: wvsprintfA.USER32(00000000,?,00000000,?,?,00000000), ref: 0019B9D1
                                                                                                                                                                                                                • Part of subcall function 0019B990: LeaveCriticalSection.KERNEL32(001DA6C8,?,?,?,?,?,00000000), ref: 0019B9F2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemsetwvsprintf$EnterLeave
                                                                                                                                                                                                              • String ID: PPPPMSG %s :%s
                                                                                                                                                                                                              • API String ID: 3980427996-569775469
                                                                                                                                                                                                              • Opcode ID: 6cca23986bba42b5a540a4eeb18cfd473ef9723f170ad7c422f4ed5c72bf0ecf
                                                                                                                                                                                                              • Instruction ID: 9c207bcaccadf5e14b8411e62bc101b6d0f3839009d71026940c2b1ff9549ded
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6cca23986bba42b5a540a4eeb18cfd473ef9723f170ad7c422f4ed5c72bf0ecf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15F096B5904109ABDF10EB54DC45FA63378FB44700F0081A9B90857241FB70AA488F91
                                                                                                                                                                                                              Function 001968B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,001D9E78,00000026,00000001,0019A9CD,?,?,?,?,?,00000000), ref: 001968BB
                                                                                                                                                                                                              • PathAppendW.SHLWAPI(001D9E78,Internet Explorer\iexplore.exe,?,?,?,?,?,00000000), ref: 001968D0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • Internet Explorer\iexplore.exe, xrefs: 001968C6
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.616908490.0000000000190000.00000040.00000400.00020000.00000000.sdmp, Offset: 00190000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_190000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Path$AppendFolderSpecial
                                                                                                                                                                                                              • String ID: Internet Explorer\iexplore.exe
                                                                                                                                                                                                              • API String ID: 2921508639-3330628412
                                                                                                                                                                                                              • Opcode ID: 92da1c7332b65e0a9f581538146fcd78fbbe98565a11b8d7544d9769bd5a54fd
                                                                                                                                                                                                              • Instruction ID: 53e62ed8b22b18c04e15a8125e813df2c8e0773a6f379b5d351cd7fc4ee2d865
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 92da1c7332b65e0a9f581538146fcd78fbbe98565a11b8d7544d9769bd5a54fd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1FC002297C031076EF605A645E8BFD93791A775F83F904152F542E96D0D7F584805512

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:3.7%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                              Total number of Nodes:200
                                                                                                                                                                                                              Total number of Limit Nodes:12
                                                                                                                                                                                                              execution_graph 5139 395c50 5145 395a20 5139->5145 5141 395cd8 5142 395c67 5142->5141 5159 3949f0 5142->5159 5144 395cc6 5146 395a2b 5145->5146 5147 395c46 5146->5147 5177 393a20 5146->5177 5147->5142 5150 395aef 5205 393080 5150->5205 5152 395b31 5153 393080 5 API calls 5152->5153 5157 395b4f 5153->5157 5154 395bf4 CreateThread CloseHandle 5155 395c0c 5154->5155 5155->5147 5158 395c2e CreateThread CloseHandle 5155->5158 5156 395a3c 5156->5147 5182 394d00 5156->5182 5157->5154 5157->5155 5158->5147 5160 394acb 5159->5160 5161 394a00 5159->5161 5160->5144 5161->5160 5162 394a0b WaitForSingleObject 5161->5162 5162->5160 5163 394a1e 5162->5163 5164 394560 8 API calls 5163->5164 5167 394a42 5164->5167 5165 394a79 5165->5144 5166 394aad ReleaseMutex 5171 394470 4 API calls 5166->5171 5167->5165 5167->5166 5346 3947c0 5167->5346 5170 394a6d 5173 394a80 5170->5173 5174 394a74 ReleaseMutex 5170->5174 5172 394ac6 5171->5172 5172->5144 5175 394470 4 API calls 5173->5175 5174->5165 5176 394a88 ReleaseMutex 5175->5176 5176->5166 5179 393a25 5177->5179 5178 393a2d 5178->5156 5179->5178 5211 3935b0 GetPEB 5179->5211 5181 393a44 5181->5156 5184 394d0e 5182->5184 5183 394d16 5183->5150 5184->5183 5185 393a20 GetPEB 5184->5185 5186 394d33 5185->5186 5187 394d3d GetVersionExA 5186->5187 5188 394d37 5186->5188 5187->5188 5189 394d56 5187->5189 5188->5150 5212 393f90 5189->5212 5191 394d5c 5218 393390 5191->5218 5193 394d7e 5227 394ae0 5193->5227 5195 394d9b 5251 393ac0 5195->5251 5197 394da6 strncpy 5198 394dd0 5197->5198 5200 394dee 5198->5200 5269 393440 5198->5269 5255 393890 5200->5255 5202 394e67 5260 394c20 5202->5260 5204 394e7e 5204->5150 5206 393890 GetPEB 5205->5206 5208 39308c 5206->5208 5207 3930bb 5207->5152 5208->5207 5335 392f90 5208->5335 5210 3930b6 5210->5152 5211->5181 5213 393f9f 5212->5213 5215 393fa6 5212->5215 5214 393890 GetPEB 5213->5214 5214->5215 5216 393890 GetPEB 5215->5216 5217 393fd1 5215->5217 5216->5217 5217->5191 5219 39339b 5218->5219 5220 3933a0 5218->5220 5219->5193 5286 3930c0 5220->5286 5223 3930c0 InitializeCriticalSection 5225 3933c3 5223->5225 5224 39342e 5224->5193 5225->5224 5290 3931d0 5225->5290 5228 394af2 5227->5228 5229 394b54 5227->5229 5228->5229 5230 394b0d strncpy sprintf CreateMutexA 5228->5230 5229->5195 5231 394b4b 5230->5231 5232 394b5c _snprintf OpenFileMappingA 5230->5232 5303 394880 5231->5303 5233 394b9d 5232->5233 5234 394b96 CloseHandle 5232->5234 5236 394ba1 5233->5236 5237 394bb4 5233->5237 5234->5233 5312 394560 5236->5312 5297 394470 5237->5297 5238 394b51 5238->5229 5241 394bad 5241->5237 5243 394bd1 5241->5243 5242 394bbc 5244 394bc8 5242->5244 5245 394bda 5242->5245 5243->5195 5246 394880 3 API calls 5244->5246 5247 394c08 5245->5247 5248 394bde WaitForSingleObject 5245->5248 5249 394bce 5246->5249 5247->5195 5248->5247 5250 394bed ReleaseMutex 5248->5250 5249->5243 5250->5247 5252 393acc 5251->5252 5253 393b10 5251->5253 5252->5253 5254 393ae0 _snprintf 5252->5254 5253->5197 5254->5197 5256 3938ae 5255->5256 5257 3938a0 5255->5257 5256->5202 5320 3935b0 GetPEB 5257->5320 5259 3938a5 5259->5202 5321 3935d0 5260->5321 5262 394c31 OpenProcessToken 5263 394c48 LookupPrivilegeValueA 5262->5263 5264 394c3c GetLastError 5262->5264 5265 394c5c GetLastError CloseHandle 5263->5265 5266 394c72 AdjustTokenPrivileges 5263->5266 5264->5204 5265->5204 5267 394ca9 CloseHandle 5266->5267 5268 394ca3 GetLastError 5266->5268 5267->5204 5268->5267 5270 39359f 5269->5270 5277 393451 5269->5277 5270->5200 5271 39348c printf printf 5273 3934c2 5271->5273 5274 3934c7 printf 5271->5274 5273->5274 5281 3934f1 5274->5281 5275 39355a 5280 393593 5275->5280 5329 393320 5275->5329 5277->5270 5277->5271 5277->5275 5279 3931d0 2 API calls 5279->5280 5280->5200 5281->5270 5322 393100 5281->5322 5283 39354a 5284 393440 6 API calls 5283->5284 5285 393551 5284->5285 5285->5200 5287 3930cb 5286->5287 5288 3930f1 5286->5288 5287->5288 5289 3930e7 InitializeCriticalSection 5287->5289 5288->5223 5289->5288 5291 3931dc 5290->5291 5292 393230 5290->5292 5291->5292 5293 3931e9 EnterCriticalSection 5291->5293 5294 3931f3 5291->5294 5292->5224 5293->5294 5295 39321d LeaveCriticalSection 5294->5295 5296 393227 5294->5296 5295->5296 5296->5224 5298 39448e _snprintf OpenFileMappingA 5297->5298 5299 394536 5297->5299 5300 394530 5298->5300 5301 3944e2 MapViewOfFile 5298->5301 5299->5242 5300->5242 5301->5299 5302 394516 CloseHandle 5301->5302 5302->5300 5304 39488b 5303->5304 5305 394890 5303->5305 5304->5238 5306 3948a4 5305->5306 5307 394897 CloseHandle 5305->5307 5308 3948b7 UnmapViewOfFile 5306->5308 5309 3948cc 5306->5309 5307->5306 5308->5306 5310 3948da CloseHandle 5309->5310 5311 3948ef 5309->5311 5310->5309 5311->5238 5318 39457a 5312->5318 5313 394470 4 API calls 5313->5318 5314 3946fd 5314->5241 5315 3945b9 _snprintf 5316 3945ed CreateFileMappingA 5315->5316 5315->5318 5316->5314 5317 394621 MapViewOfFile 5316->5317 5317->5318 5319 394706 CloseHandle 5317->5319 5318->5313 5318->5314 5318->5315 5318->5316 5319->5241 5320->5259 5321->5262 5323 39310c 5322->5323 5324 393161 5322->5324 5323->5324 5325 393119 EnterCriticalSection 5323->5325 5326 393123 5323->5326 5324->5283 5325->5326 5327 393158 5326->5327 5328 39314e LeaveCriticalSection 5326->5328 5327->5283 5328->5327 5330 393332 5329->5330 5331 393385 5329->5331 5330->5331 5332 39333c EnterCriticalSection 5330->5332 5333 393346 5330->5333 5331->5279 5332->5333 5333->5331 5334 39337b LeaveCriticalSection 5333->5334 5334->5331 5336 392fa2 5335->5336 5337 393074 5335->5337 5336->5337 5338 392fc2 ReadProcessMemory 5336->5338 5337->5210 5339 393059 5338->5339 5340 392fe0 5338->5340 5339->5210 5340->5339 5341 393004 WriteProcessMemory 5340->5341 5341->5339 5342 393022 5341->5342 5342->5339 5343 393028 WriteProcessMemory 5342->5343 5343->5339 5344 39303c 5343->5344 5344->5339 5345 393044 WriteProcessMemory 5344->5345 5345->5339 5347 3947d1 5346->5347 5348 394875 5346->5348 5347->5348 5349 3947ed InterlockedIncrement 5347->5349 5348->5170 5350 394807 5349->5350 5351 394470 _snprintf OpenFileMappingA MapViewOfFile CloseHandle 5350->5351 5352 394560 8 API calls 5350->5352 5353 39485c 5350->5353 5351->5350 5352->5350 5353->5170 5354 395040 5355 39504c 5354->5355 5356 395060 5354->5356 5355->5356 5358 394e90 5355->5358 5359 395031 5358->5359 5360 394ea2 5358->5360 5359->5356 5360->5359 5361 394fa8 5360->5361 5364 393440 9 API calls 5360->5364 5365 392f90 4 API calls 5360->5365 5366 396080 5361->5366 5364->5360 5365->5360 5368 39608e 5366->5368 5369 395022 5366->5369 5367 393440 9 API calls 5367->5368 5368->5367 5368->5369 5369->5356

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 00394C20 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000028,?,00394E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 00394C32
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00394C3C
                                                                                                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00394C52
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00394C5C
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00394C66
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1673749002-0
                                                                                                                                                                                                              • Opcode ID: ceabb13376d8ca26c906b7f7d2d2275f512e57a38d23e841d457e2fb0a6de038
                                                                                                                                                                                                              • Instruction ID: d64b4b7ad4cb68342fe75c7aab8826a8f4673f1cc8d8a1b21eae1da7a9380cfe
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ceabb13376d8ca26c906b7f7d2d2275f512e57a38d23e841d457e2fb0a6de038
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 74118675A00208AFDB15DFE4DD09FAEB7BCEB4A751F014549FE09D6240DA7199048B61
                                                                                                                                                                                                              Function 00394AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111synchronizationstringCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strncpy.MSVCRT(EDB88F28,00010000,00000104,EDB88320,00000000,00000D10,?,00000000), ref: 00394B1A
                                                                                                                                                                                                              • sprintf.MSVCRT(?,-%sMutex,00010000,EDB88F28,00010000,00000104,EDB88320,00000000,00000D10,?,00000000), ref: 00394B2C
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00394B3F
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s_0,00010000,?,?,?,?,?,?,?,?,?,00000000), ref: 00394B6F
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32(000F001F,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00394B85
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00394B97
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00394BE3
                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00394C02
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
                                                                                                                                                                                                              • String ID: %s_0$-%sMutex
                                                                                                                                                                                                              • API String ID: 4144850300-892854768
                                                                                                                                                                                                              • Opcode ID: 07ab5479319c05f035af82f737b6b8a8abac7be1e8e70bdf3a86b2d17f1a061e
                                                                                                                                                                                                              • Instruction ID: e8394faeee8d84add2d9ab3e4c901f0ddfd5b8f17d3e34ef0b9c206adc9a725e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 07ab5479319c05f035af82f737b6b8a8abac7be1e8e70bdf3a86b2d17f1a061e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 423159B26002046BDB21DF64DC82FDBB3ECEF45714F054559FE98DB280EAB1D98587A0
                                                                                                                                                                                                              Function 00395A20 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 189threadCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 26 395a20-395a31 call 3935e0 29 395c49-395c4c 26->29 30 395a37-395a3e call 393a20 26->30 30->29 33 395a44-395a5b 30->33 34 395a61-395a68 33->34 35 395ae5-395b4a call 394d00 call 393080 * 2 33->35 34->35 36 395a6a-395a76 34->36 53 395b4f-395b63 35->53 36->35 38 395a78-395a7b call 393920 36->38 41 395a80-395a87 38->41 44 395a8d-395a97 41->44 45 395c46-395c48 41->45 47 395a99 44->47 48 395a9c-395aa0 44->48 45->29 47->48 49 395ad8-395ae3 48->49 50 395aa2-395aa5 48->50 49->35 49->38 52 395aaa-395aac 50->52 54 395aae-395ab1 52->54 55 395ab3 52->55 56 395b70-395b85 53->56 57 395b65-395b6c 53->57 58 395ab7-395ac2 call 393750 54->58 55->58 59 395bcc-395be5 56->59 60 395b87-395b8b 56->60 57->56 58->45 72 395ac8-395ad3 58->72 64 395bf4-395c0a CreateThread CloseHandle 59->64 65 395be7-395bf2 59->65 62 395b8d-395ba7 call 3939a0 60->62 63 395bc3-395bca 60->63 62->63 76 395ba9-395bbf 62->76 63->59 63->60 66 395c0c-395c1f 64->66 65->64 65->66 70 395c2e-395c44 CreateThread CloseHandle 66->70 71 395c21-395c2c 66->71 70->45 71->45 71->70 74 395ad5 72->74 75 395aa7 72->75 74->49 75->52 76->63
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_00005070,00000000,00000000,00000000), ref: 00395C03
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00395C0A
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_000050F0,00000000,00000000,00000000), ref: 00395C3D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00395C44
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleThread
                                                                                                                                                                                                              • String ID: LdrLoadDll$NtResumeThread$ntdll.dll
                                                                                                                                                                                                              • API String ID: 3032276028-1814628691
                                                                                                                                                                                                              • Opcode ID: 0e8e93cf40c39f1baeec42cbb0f54d3c55288673c49b9a7f560fb3d04a709c8f
                                                                                                                                                                                                              • Instruction ID: df0c4b221560bd31140d7dd8be6b74ecf72e9aab90efde472bfdc20e52c3edaf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0e8e93cf40c39f1baeec42cbb0f54d3c55288673c49b9a7f560fb3d04a709c8f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C61CC75B40B02ABDB23DF69DC81FA673A8AB44704F164529E805DB791D770F881CB94
                                                                                                                                                                                                              Function 00394D00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: NtGetNextProcess$SeDebugPrivilege$ntdll.dll
                                                                                                                                                                                                              • API String ID: 0-503679825
                                                                                                                                                                                                              • Opcode ID: 75895b427f67e926070e513fd66a76cd055e45d0c31512db873949a2ef9fcba7
                                                                                                                                                                                                              • Instruction ID: c566efdf51ffe7c27671cd2980378004ad7c4dcbffbb0147d49f99ce2be39dcf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75895b427f67e926070e513fd66a76cd055e45d0c31512db873949a2ef9fcba7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F31D6B9A4521476DF23BBB5AC07FFE3258EB04B00F004555FC48DB292FEB46A408BA5
                                                                                                                                                                                                              Function 00392F90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103injectionCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 132 392f90-392f9c 133 392fa2-392fa7 132->133 134 393074-39307b 132->134 133->134 135 392fad-392fb2 133->135 135->134 136 392fb8-392fbc 135->136 136->134 137 392fc2-392fda ReadProcessMemory 136->137 138 39306b-393073 137->138 139 392fe0-392ff6 call 392e40 137->139 139->138 142 392ff8-393020 call 392e20 WriteProcessMemory 139->142 142->138 145 393022-393026 142->145 145->138 146 393028-39303a WriteProcessMemory 145->146 146->138 147 39303c-393042 146->147 147->138 148 393044-393057 WriteProcessMemory 147->148 148->138 149 393059-39305d 148->149 149->138 150 39305f-39306a 149->150
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • ReadProcessMemory.KERNEL32(?,?,00000000,00000010,?), ref: 00392FD2
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(?,00000000,?,00000020,?), ref: 0039301C
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(?,?,?,00000000,00000020), ref: 00393036
                                                                                                                                                                                                              • WriteProcessMemory.KERNEL32(?,00000000,00000000,00000004,00000020), ref: 00393053
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MemoryProcess$Write$Read
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2454571318-3916222277
                                                                                                                                                                                                              • Opcode ID: 54814ee8aab886cb684056145811f6266e56ca678ef0a713f8b881bf45434767
                                                                                                                                                                                                              • Instruction ID: 2ef6ac5a7b02dfe3261aa6d6948503740a2cadd380baaa2d2678a2f66ac1d65c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 54814ee8aab886cb684056145811f6266e56ca678ef0a713f8b881bf45434767
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D316DB260050DAADF12DE99DC80EEFB3BCEB40754F114265E90696244E771AF46C7A0
                                                                                                                                                                                                              Function 00394470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 151 394470-394488 152 39448e-3944e0 _snprintf OpenFileMappingA 151->152 153 394544-39455b 151->153 154 394530-394535 152->154 155 3944e2-394514 MapViewOfFile 152->155 156 394536-39453d 155->156 157 394516-394528 CloseHandle 155->157 156->153 157->154
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s_%d,EDB88F28,00000000), ref: 003944A7
                                                                                                                                                                                                              • OpenFileMappingA.KERNEL32(000F001F,00000000,?), ref: 003944BD
                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 003944F0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0039451B
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseHandleMappingOpenView_snprintf
                                                                                                                                                                                                              • String ID: %s_%d
                                                                                                                                                                                                              • API String ID: 460513966-1933919280
                                                                                                                                                                                                              • Opcode ID: 1046bfb25ce7faa97e102ab8aaa01ee766df32a232c32bfea315aaa8eed8e86f
                                                                                                                                                                                                              • Instruction ID: 8f9a8001e7088d20ad1e273a63d02316cbcb9001bbf766f532dc4a5e48645842
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1046bfb25ce7faa97e102ab8aaa01ee766df32a232c32bfea315aaa8eed8e86f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D21AEB22507068BD332CF58DD89B72B3E8EB84304F44857CEB4687285DB79B860DB40

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 003A0430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 712 3a0430-3a049e lstrlenA GetProcessHeap HeapAlloc memset GetProcessHeap 713 3a07c2-3a07ca 712->713 714 3a04a4-3a04b8 lstrcpyA 712->714 715 3a04be-3a04d0 sscanf 714->715 716 3a0695-3a06ab sscanf 714->716 717 3a0792-3a07a6 HeapFree 715->717 718 3a04d6-3a04e6 strstr 715->718 716->717 719 3a06b1-3a06c3 strstr 716->719 723 3a07a8-3a07ac HeapFree 717->723 724 3a07ae-3a07b0 717->724 718->717 720 3a04ec-3a050f lstrlenA * 2 HeapAlloc 718->720 721 3a06c9-3a06df strstr 719->721 722 3a078f 719->722 720->717 727 3a0515-3a0528 strtok 720->727 721->722 728 3a06e5-3a070a lstrlenA * 2 HeapAlloc 721->728 722->717 723->724 725 3a07b8-3a07c1 724->725 726 3a07b2-3a07b6 HeapFree 724->726 726->725 727->717 729 3a052e-3a053a lstrcpyA 727->729 728->722 730 3a0710-3a0756 lstrlenA * 2 lstrcpynA lstrlenA * 2 HeapAlloc 728->730 731 3a0540-3a0549 729->731 730->722 732 3a0758-3a078c lstrlenA * 2 _snprintf 730->732 733 3a05fb-3a060f strtok 731->733 734 3a054f-3a0561 _memicmp 731->734 732->722 733->731 735 3a0615 733->735 736 3a058b-3a05a0 _memicmp 734->736 737 3a0563-3a0589 lstrlenA _snprintf 734->737 738 3a062d-3a0672 lstrlenA _snprintf lstrlenA * 2 HeapAlloc 735->738 740 3a05a2-3a05ae lstrcatA 736->740 741 3a05b0-3a05c5 _memicmp 736->741 739 3a05ef-3a05f3 lstrcatA 737->739 738->722 743 3a0678-3a0690 _snprintf 738->743 742 3a05f8-3a05f9 lstrcatA 739->742 740->742 744 3a05c7-3a05d3 lstrcatA 741->744 745 3a05d5-3a05ea _memicmp 741->745 742->733 743->722 744->742 746 3a05ec 745->746 747 3a0617-3a062b lstrcatA * 3 745->747 746->739 747->738
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 003A0446
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000001), ref: 003A044C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 003A0453
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 003A048B
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32 ref: 003A0493
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 003A04A9
                                                                                                                                                                                                              • sscanf.MSVCRT(00000000,SDG %d,?), ref: 003A04C5
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,X-MMS-IM-Format: ), ref: 003A04DC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00392780), ref: 003A04F0
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 003A04FA
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 003A0505
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A2B84), ref: 003A051B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,003A1335), ref: 003A0534
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,Content-Length: ,00000010), ref: 003A0557
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00392780), ref: 003A0567
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,Content-Length: %d,00000000), ref: 003A057B
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,From: ,00000006), ref: 003A0596
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 003A05A7
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 003A05F1
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A2B84), ref: 003A05F9
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A2B84), ref: 003A0602
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 003A061C
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 003A0624
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00392780), ref: 003A062B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 003A062E
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000103,SDG %d %d,?,00000000), ref: 003A0646
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 003A064F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 003A065A
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000040), ref: 003A0667
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,0000003F,%s%s,?,00000000), ref: 003A0688
                                                                                                                                                                                                              • sscanf.MSVCRT(00000000,MSG %d %1s,?,?), ref: 003A06A0
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,003A2B84), ref: 003A06B7
                                                                                                                                                                                                              • strstr.MSVCRT(-00000002,), ref: 003A06D2
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 003A06E6
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 003A06F3
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 003A06FF
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 003A0714
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000002), ref: 003A0721
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(?,-00000002,?), ref: 003A072C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 003A0736
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00392780), ref: 003A073E
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,?), ref: 003A074B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00392780), ref: 003A0761
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00392780), ref: 003A076A
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,?,MSG %d %s %d%s%s,?,?,00000004), ref: 003A0787
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 003A079F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 003A07AC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 003A07B6
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
                                                                                                                                                                                                              • API String ID: 375969099-2909086048
                                                                                                                                                                                                              • Opcode ID: 15815ccfb9fc733584c9ff2f3952bd9327cfb334d9a8a442d13c339dc7c1daaf
                                                                                                                                                                                                              • Instruction ID: 039579f8cae378155fbea6fe35e689cc1e7e3adf2bfe6bfcee6493fea2428349
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15815ccfb9fc733584c9ff2f3952bd9327cfb334d9a8a442d13c339dc7c1daaf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FEA14DB6E00309BBDB16DBA48C86EBF77BCEF4A740F144555F904A7241EA75EE048B60
                                                                                                                                                                                                              Function 0039F430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431filestringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 748 39f430-39f62e call 3a0f10 memset * 11 sprintf * 2 wsprintfW sprintf * 3 wsprintfW * 2 call 391cf0 753 39f630-39f643 call 391ea0 748->753 754 39f672-39f6b2 SetFileAttributesA * 3 CreateDirectoryA 748->754 753->754 762 39f645-39f655 _stricmp 753->762 755 39f6c1-39f6d6 CopyFileW 754->755 756 39f6b4-39f6bf GetLastError 754->756 758 39f669-39f671 755->758 759 39f6d8-39f706 lstrlenA call 391c50 call 397700 755->759 756->755 756->758 767 39f70c-39f733 call 3935f0 759->767 768 39f8c2-39f8d0 Sleep 759->768 762->754 764 39f657-39f667 _stricmp 762->764 764->754 764->758 779 39f740-39f747 CreateFileW 767->779 780 39f735-39f73e 767->780 770 39f8d2-39f8d8 768->770 771 39f8e5-39f8eb 768->771 773 39f8f8-39f900 770->773 774 39f8da-39f8e3 770->774 775 39f8ed-39f8f6 771->775 776 39f903-39f909 771->776 781 39f901 SetFileAttributesA 773->781 774->781 775->781 777 39f90b-39f911 776->777 778 39f91e-39f924 776->778 782 39f931-39f939 777->782 783 39f913-39f91c 777->783 784 39f93c-39f962 call 39f130 778->784 785 39f926-39f92f 778->785 786 39f74d-39f751 779->786 780->786 781->776 788 39f93a SetFileAttributesA 782->788 783->788 795 39f993-39f9a3 call 397700 784->795 796 39f964-39f98d CreateFileA GetFileSize LockFile 784->796 785->788 786->758 787 39f757-39f78e 786->787 791 39f792-39f79f 787->791 788->784 793 39f7bb-39f7d0 791->793 794 39f7a1-39f7b9 call 393870 791->794 798 39f821-39f82e lstrlenA 793->798 799 39f7d2-39f81f lstrcpyA lstrcatA * 2 lstrlenA 793->799 794->793 805 39f9a5-39f9ce CreateFileA GetFileSize LockFile 795->805 806 39f9d4-39f9df 795->806 796->795 802 39f834-39f84f WriteFile call 393870 798->802 799->802 808 39f851-39f855 802->808 809 39f856-39f85b 802->809 805->806 808->809 810 39f85d 809->810 811 39f8a6-39f8aa 809->811 814 39f860-39f898 call 39f3b0 lstrlenA WriteFile call 393870 810->814 812 39f790 811->812 813 39f8b0-39f8c0 CloseHandle 811->813 812->791 813->768 819 39f89a-39f89e 814->819 820 39f89f-39f8a4 814->820 819->820 820->811 820->814
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT ref: 0039F459
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0039F472
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 0039F48B
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 0039F4A4
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 0039F4BD
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,?,00000000,000003FF,?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 0039F4D6
                                                                                                                                                                                                              • memset.MSVCRT ref: 0039F4F2
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0039F50B
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,0000040E,?,00000000,00000103), ref: 0039F526
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 0039F541
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000206,?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 0039F55C
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%sautorun.inf,?,?,00000000,00000206,?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 0039F571
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%sautorun.tmp,?), ref: 0039F586
                                                                                                                                                                                                              • wsprintfW.USER32(?,003A3018,?,?,%sautorun.tmp,?), ref: 0039F5A4
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s\%s,003DBDB0,003DBEB4), ref: 0039F5BC
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s%s,?,003DBDB0,?,%s\%s,003DBDB0,003DBEB4), ref: 0039F5D3
                                                                                                                                                                                                              • sprintf.MSVCRT(?,%s%s,?,?,?,%s%s,?,003DBDB0,?,%s\%s,003DBDB0,003DBEB4), ref: 0039F5EC
                                                                                                                                                                                                              • wsprintfW.USER32(?,003A3018,?), ref: 0039F607
                                                                                                                                                                                                              • wsprintfW.USER32(?,%S%S\Desktop.ini,?,003DBDB0), ref: 0039F61B
                                                                                                                                                                                                                • Part of subcall function 00391CF0: GetFileAttributesW.KERNEL32(?), ref: 00391CF7
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,ERR), ref: 0039F64B
                                                                                                                                                                                                              • _stricmp.MSVCRT(003DA920,00000000), ref: 0039F65D
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0039F684
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0039F692
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000080), ref: 0039F6A0
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 0039F6AA
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0039F6B4
                                                                                                                                                                                                              • CopyFileW.KERNEL32(003DB9A0,?,00000000), ref: 0039F6CE
                                                                                                                                                                                                              • lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 0039F6DE
                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0039F747
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00003A2F), ref: 0039F7DA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,?), ref: 0039F7EE
                                                                                                                                                                                                                • Part of subcall function 00391EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00391ECD
                                                                                                                                                                                                                • Part of subcall function 00391EA0: GetLastError.KERNEL32 ref: 00391EDA
                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,003A2B84), ref: 0039F800
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 0039F813
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00003A2F,?,00000000), ref: 0039F828
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00003A2F,00000000), ref: 0039F837
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00000000), ref: 0039F87C
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000), ref: 0039F88B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0039F8B1
                                                                                                                                                                                                              • Sleep.KERNEL32(00000032), ref: 0039F8C4
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 0039F901
                                                                                                                                                                                                              • SetFileAttributesA.KERNEL32(?,00000004), ref: 0039F93A
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0039F97D
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0039F984
                                                                                                                                                                                                              • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0039F98D
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0039F9BE
                                                                                                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0039F9C5
                                                                                                                                                                                                              • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0039F9CE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
                                                                                                                                                                                                              • String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
                                                                                                                                                                                                              • API String ID: 2867265384-3663527224
                                                                                                                                                                                                              • Opcode ID: 1d5790f65d9683e2c909045d834ef039b012b5e90e24fe6766d131ab0fb305f0
                                                                                                                                                                                                              • Instruction ID: 6d0b479cf81ee5161f37adf1d8b1a803bb3726333605609be5fdec3ecb67bcbb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1d5790f65d9683e2c909045d834ef039b012b5e90e24fe6766d131ab0fb305f0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1E1A471940228BEDB22DB64DC85FEB777CEB49B40F004599F609E6180D7B4AB84CFA5
                                                                                                                                                                                                              Function 00397870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000001FF,?,00000000,?), ref: 00397898
                                                                                                                                                                                                              • lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 0039795D
                                                                                                                                                                                                              • _snprintf.MSVCRT(003DA2B0,000001FF,003A13EC,-00000005,?,?,00000000,?), ref: 0039797B
                                                                                                                                                                                                              • _snprintf.MSVCRT(003DA4B0,000001FF,003A13EC,-00000005,?,?,00000000,?), ref: 003979B7
                                                                                                                                                                                                              • lstrlenA.KERNEL32(003DA2B0,?,00000000,?), ref: 00397A5A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(003DA4B0), ref: 00397A69
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,ftp://%s:%s@%s:%d,003DA2B0,003DA4B0,00000000,00000000), ref: 00397AD9
                                                                                                                                                                                                              • _stricmp.MSVCRT(003DA2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,003DA2B0,003DA4B0,00000000,00000000), ref: 00397AE8
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,000001FF,pop3://%s:%s@%s:%d,003DA2B0,003DA4B0,00000000,00000000), ref: 00397B66
                                                                                                                                                                                                                • Part of subcall function 00392460: GetProcessHeap.KERNEL32(?,003920DE,?), ref: 0039246C
                                                                                                                                                                                                                • Part of subcall function 00392460: HeapAlloc.KERNEL32(?,00000008,003920DE,?,003920DE,?), ref: 0039247E
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(003DA2B0,003A1335,?,00000000,?), ref: 00397BBC
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(003DA4B0,003A1335), ref: 00397BC8
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
                                                                                                                                                                                                              • String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
                                                                                                                                                                                                              • API String ID: 389836911-2374598668
                                                                                                                                                                                                              • Opcode ID: 3517a960e016825acc5dc7e276d4ece49db268359d355dcb727ae67cae443e9c
                                                                                                                                                                                                              • Instruction ID: db97a0f8d01a1ff75f81f464ca4213f7bd3e1df01d430229e700ea59bfa264f2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3517a960e016825acc5dc7e276d4ece49db268359d355dcb727ae67cae443e9c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05816931A6D745AEEF33AF689D4AFAE3BE8DB12704F094416E804A63C1D7B0DD408253
                                                                                                                                                                                                              Function 0039FE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000,003A037C,?,003A32E4,00000000,00000000,httpi), ref: 0039FE11
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FE40
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0039FE47
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FE5E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FE72
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FE7C
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000002), ref: 0039FE89
                                                                                                                                                                                                              • strtok.MSVCRT(?,003A19DC), ref: 0039FEA2
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,003A1335), ref: 0039FEBB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A19DC), ref: 0039FECD
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0039FEE4
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,00000000,00000000), ref: 0039FEEF
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0039FF0A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FF14
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0039FF1F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FF33
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A3328), ref: 0039FF4B
                                                                                                                                                                                                              • strstr.MSVCRT(?,003A2B54), ref: 0039FF5C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0039FF65
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FF6B
                                                                                                                                                                                                              • strncat.MSVCRT(00000000,?,00000000), ref: 0039FF77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A2B54), ref: 0039FF85
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FF8F
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0039FF9A
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039FFAA
                                                                                                                                                                                                                • Part of subcall function 0039FD80: isalnum.MSVCRT(00000000,00000000,756F59EB,00000000,?,0039FFB9,00000000,00000000,00000000), ref: 0039FDAC
                                                                                                                                                                                                                • Part of subcall function 0039FD80: strchr.MSVCRT(-_.!~*'(),00000000,00000000), ref: 0039FDBE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 0039FFBE
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0039FFCB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0039FFDF
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A19DC), ref: 0039FFEC
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 003A000F
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 003A001C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 003A003C
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 423345748-0
                                                                                                                                                                                                              • Opcode ID: 1843693495bc188ceff079f35bf67d033f5df1c9071cf3f6e3ec609fff37abb1
                                                                                                                                                                                                              • Instruction ID: b01922e8f11f957271b903f5976330aa9baf535ece864c84681e2aa77090b609
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1843693495bc188ceff079f35bf67d033f5df1c9071cf3f6e3ec609fff37abb1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31616B76A00219BFDB16DBA4DC89EBF7B7CEB86740F104119F909E7240DB74D9418BA1
                                                                                                                                                                                                              Function 00396A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 00396A68
                                                                                                                                                                                                              • lstrlenA.KERNEL32 ref: 00396B03
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,00000000,00000000), ref: 00396B0E
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,JOIN,00000004), ref: 00396B22
                                                                                                                                                                                                              • _memicmp.MSVCRT(?,PRIVMSG,00000007), ref: 00396B36
                                                                                                                                                                                                              • sscanf.MSVCRT(?,JOIN %255s,?), ref: 00396B4F
                                                                                                                                                                                                              • sscanf.MSVCRT(?,PRIVMSG %255s,?), ref: 00396B69
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00396BD5
                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(003DA710,00000080), ref: 00396C31
                                                                                                                                                                                                              • MoveFileExW.KERNEL32(003DA710,00000000,00000004), ref: 00396C40
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00396C60
                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00396C67
                                                                                                                                                                                                                • Part of subcall function 0039A310: memset.MSVCRT ref: 0039A335
                                                                                                                                                                                                                • Part of subcall function 0039A310: memset.MSVCRT ref: 0039A34F
                                                                                                                                                                                                                • Part of subcall function 0039A310: memset.MSVCRT(?,00000000,000003FF), ref: 0039A369
                                                                                                                                                                                                                • Part of subcall function 0039A310: _vsnprintf.MSVCRT(?,000003FE,003A0A8E,000001FE,?,00000000,000003FF), ref: 0039A382
                                                                                                                                                                                                                • Part of subcall function 0039A310: sprintf.MSVCRT(00000000,003A13EC,?,?,000003FE,003A0A8E,000001FE,?,00000000,000003FF), ref: 0039A39A
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003974EB,%s.%s,blk,?,?,000001FE,003A0A8E), ref: 0039A3AD
                                                                                                                                                                                                                • Part of subcall function 0039A310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,003974EB,%s.%s), ref: 0039A3CC
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003974EB), ref: 0039A3DB
                                                                                                                                                                                                                • Part of subcall function 0039A310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 0039A3EC
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0039A3FB
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0039A404
                                                                                                                                                                                                                • Part of subcall function 0039A310: EnterCriticalSection.KERNEL32(003DAC34,?,?,00000000), ref: 0039A436
                                                                                                                                                                                                                • Part of subcall function 0039A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0039A452
                                                                                                                                                                                                                • Part of subcall function 0039A310: LeaveCriticalSection.KERNEL32(003DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0039A464
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
                                                                                                                                                                                                              • String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
                                                                                                                                                                                                              • API String ID: 1085873876-1467418891
                                                                                                                                                                                                              • Opcode ID: d4546c21a5c2783a7b812024fc6983e494ca9017e7606adb7e23f6caad86b4c0
                                                                                                                                                                                                              • Instruction ID: c33e1e6a08faf751adc78b3637faf6082371bbfa396da8e73d8818f587cb373b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d4546c21a5c2783a7b812024fc6983e494ca9017e7606adb7e23f6caad86b4c0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94511776E01204BBDF239F959D87FEE37ACEB46740F050429F904E2181E6B0A944CAA2
                                                                                                                                                                                                              Function 003A0050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103,00000000,00000000,00000000), ref: 003A0071
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 003A0080
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 003A00AB
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003A00B6
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,00000000), ref: 003A00CB
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 003A00D2
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003A00E3
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A2B84), ref: 003A00F9
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,003A19DC), ref: 003A0117
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,003A2B54), ref: 003A0129
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A2B84), ref: 003A0141
                                                                                                                                                                                                              • _memicmp.MSVCRT(00000000,Content-Length: ,00000010), ref: 003A014E
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 003A0160
                                                                                                                                                                                                              • _snprintf.MSVCRT(00000000,00000103,003A2B10,00000000), ref: 003A0177
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 003A018A
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A2B84), ref: 003A0193
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,), ref: 003A01AB
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,00000000), ref: 003A01B2
                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003A01BE
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
                                                                                                                                                                                                              • String ID: $Content-Length:
                                                                                                                                                                                                              • API String ID: 4006885983-3599722475
                                                                                                                                                                                                              • Opcode ID: 7c3d6222e7ecb1e96d548c45257596bcfb4628f94a6ae9d99ee1ab369de10448
                                                                                                                                                                                                              • Instruction ID: 4d8edfdfb165287ff1e26a91422f6feb2d968b48b7d5863c7e27bda5d302b15b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c3d6222e7ecb1e96d548c45257596bcfb4628f94a6ae9d99ee1ab369de10448
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EB412479A00318BBDB26AF649C86FEF776CDF57711F004114FD08A6281EBF48A458AA1
                                                                                                                                                                                                              Function 0039D220 Relevance: 34.7, APIs: 11, Strings: 12, Instructions: 209stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strstrstrtok$lstrcmplstrlen
                                                                                                                                                                                                              • String ID: W:$001$332$376$433$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
                                                                                                                                                                                                              • API String ID: 4048585210-3434640366
                                                                                                                                                                                                              • Opcode ID: 5fd566a19a766937611c81d3d109473730643093bdd9ad08344201c18f68afc8
                                                                                                                                                                                                              • Instruction ID: d6430e268523a41ad53487767c983ea63d3373edfd907d531c9a38dabb788132
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5fd566a19a766937611c81d3d109473730643093bdd9ad08344201c18f68afc8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE51FAB6B4020927DF12B769BC83EAA736CEB55715F004565FC08D6242FB71ED1146E1
                                                                                                                                                                                                              Function 0039AE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00397CC2,00000000,003A2914,?,?,?,?,?,?), ref: 0039AE11
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000001,?,00397CC2,00000000,003A2914,?,?,?,?,?,?,?,00000000), ref: 0039AE23
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 0039AE41
                                                                                                                                                                                                              • strstr.MSVCRT(?,003A19DC), ref: 0039AE59
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0039AE70
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0039AE77
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A2B54), ref: 0039AE7F
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A19DC), ref: 0039AE8E
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0039AEA1
                                                                                                                                                                                                              • _strnicmp.MSVCRT(00000000,00000000,00000000), ref: 0039AEA6
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A19DC), ref: 0039AEB9
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0039AED5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0039AEEB
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,003A2B54), ref: 0039AF10
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0039AF20
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0039AF27
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000001), ref: 0039AF2B
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001), ref: 0039AF3D
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(?,00000001), ref: 0039AF58
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 0039AF5F
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000001,?,00000001), ref: 0039AF6B
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,00000001), ref: 0039AF82
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,00000001), ref: 0039AF91
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3119447416-0
                                                                                                                                                                                                              • Opcode ID: 2941a1e084dfe77556704937b7de2c0c61e3c871abefc04cc9a159d7a7b4bc14
                                                                                                                                                                                                              • Instruction ID: fe436b138b4736154bc72b27f3858cb17ba3ef65c46bebea1c9c13f26094125b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2941a1e084dfe77556704937b7de2c0c61e3c871abefc04cc9a159d7a7b4bc14
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4641A075A01614ABDB12DFA4DC81FAB77BCEF8A740F144119FE049B280DA74ED1187E6
                                                                                                                                                                                                              Function 00397C00 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 175stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,003A19DC,00000000,00000000), ref: 00397C62
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 00397D58
                                                                                                                                                                                                              • _stricmp.MSVCRT(00000000,WHM), ref: 00397D71
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,WHCMS), ref: 00397D8A
                                                                                                                                                                                                              • _stricmp.MSVCRT(?,Directadmin), ref: 00397DA3
                                                                                                                                                                                                                • Part of subcall function 0039A310: memset.MSVCRT ref: 0039A335
                                                                                                                                                                                                                • Part of subcall function 0039A310: memset.MSVCRT ref: 0039A34F
                                                                                                                                                                                                                • Part of subcall function 0039A310: memset.MSVCRT(?,00000000,000003FF), ref: 0039A369
                                                                                                                                                                                                                • Part of subcall function 0039A310: _vsnprintf.MSVCRT(?,000003FE,003A0A8E,000001FE,?,00000000,000003FF), ref: 0039A382
                                                                                                                                                                                                                • Part of subcall function 0039A310: sprintf.MSVCRT(00000000,003A13EC,?,?,000003FE,003A0A8E,000001FE,?,00000000,000003FF), ref: 0039A39A
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003974EB,%s.%s,blk,?,?,000001FE,003A0A8E), ref: 0039A3AD
                                                                                                                                                                                                                • Part of subcall function 0039A310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,003974EB,%s.%s), ref: 0039A3CC
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003974EB), ref: 0039A3DB
                                                                                                                                                                                                                • Part of subcall function 0039A310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 0039A3EC
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0039A3FB
                                                                                                                                                                                                                • Part of subcall function 0039A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0039A404
                                                                                                                                                                                                                • Part of subcall function 0039A310: EnterCriticalSection.KERNEL32(003DAC34,?,?,00000000), ref: 0039A436
                                                                                                                                                                                                                • Part of subcall function 0039A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0039A452
                                                                                                                                                                                                                • Part of subcall function 0039A310: LeaveCriticalSection.KERNEL32(003DAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0039A464
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00397E02
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 00397E12
                                                                                                                                                                                                                • Part of subcall function 003973E0: memset.MSVCRT(?,00000000,000001FF), ref: 00397401
                                                                                                                                                                                                                • Part of subcall function 003973E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00397419
                                                                                                                                                                                                                • Part of subcall function 003973E0: lstrlenA.KERNEL32(?), ref: 00397431
                                                                                                                                                                                                                • Part of subcall function 003973E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00397449
                                                                                                                                                                                                                • Part of subcall function 003973E0: _vsnprintf.MSVCRT(?,000001FE,003A0A8E,?), ref: 0039746B
                                                                                                                                                                                                                • Part of subcall function 003973E0: lstrlenA.KERNEL32(?), ref: 0039747A
                                                                                                                                                                                                                • Part of subcall function 00397330: memset.MSVCRT(?,00000000,000001FF), ref: 00397351
                                                                                                                                                                                                                • Part of subcall function 00397330: lstrlenA.KERNEL32(?), ref: 00397369
                                                                                                                                                                                                                • Part of subcall function 00397330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00397381
                                                                                                                                                                                                                • Part of subcall function 00397330: _vsnprintf.MSVCRT(00000000,000001FE,003A0AAD,?), ref: 003973A3
                                                                                                                                                                                                                • Part of subcall function 00397330: lstrlenA.KERNEL32(00000000), ref: 003973B2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
                                                                                                                                                                                                              • String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$4):$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
                                                                                                                                                                                                              • API String ID: 3716863481-3286234881
                                                                                                                                                                                                              • Opcode ID: baa13cb29c23e770da108b7976eb2857d7983729892bda502314ba86ad686800
                                                                                                                                                                                                              • Instruction ID: aaaa177ab463fbedc5f4e5fd2278532eaf5a66574f5038897a98f30e90fd7f85
                                                                                                                                                                                                              • Opcode Fuzzy Hash: baa13cb29c23e770da108b7976eb2857d7983729892bda502314ba86ad686800
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C251BEB9E24615ABDF13DB959C82DBB736CEF46700F094518F806A6281E670ED02CBA1
                                                                                                                                                                                                              Function 0039AA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000103), ref: 0039AA31
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0039AA45
                                                                                                                                                                                                              • InternetOpenA.WININET(00000000,?,?,?,?), ref: 0039AA60
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 0039AA78
                                                                                                                                                                                                              • InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0039AA8C
                                                                                                                                                                                                              • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 0039AAC0
                                                                                                                                                                                                              • InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 0039AAE2
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00001000), ref: 0039AB15
                                                                                                                                                                                                              • InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 0039AB67
                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(?), ref: 0039AB85
                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0039ABA5
                                                                                                                                                                                                              • InternetCloseHandle.WININET(00000000), ref: 0039ABE7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
                                                                                                                                                                                                              • String ID: Mozilla/4.0
                                                                                                                                                                                                              • API String ID: 2392773942-2634101963
                                                                                                                                                                                                              • Opcode ID: 04d27bbd82cadc40a91354b220d254568faacbce4a9a77550b085960c1bd1e03
                                                                                                                                                                                                              • Instruction ID: 10230bc642b55290c29c4d2e84a6f6556ed146055468d851dfaadf062bcd3e03
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 04d27bbd82cadc40a91354b220d254568faacbce4a9a77550b085960c1bd1e03
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A051AC71A01246EFDB22CF59EC84FAAB7ECEB89300F06456EE808D7250D770A944DF91
                                                                                                                                                                                                              Function 0039EE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CoCreateInstance.OLE32(003A3634,00000000,00000001,003A3614,?), ref: 0039EE5B
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000207), ref: 0039EE81
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0039EE9A
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,003A2C78), ref: 0039EEAE
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,?), ref: 0039EEBB
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,0000015C), ref: 0039EED5
                                                                                                                                                                                                              • SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 0039EEF4
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,00000107), ref: 0039EF68
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(00000000,?), ref: 0039EF7B
                                                                                                                                                                                                              • lstrcatA.KERNEL32(00000000,.lnk), ref: 0039EF89
                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0039EFA4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
                                                                                                                                                                                                              • String ID: .lnk$shell32.dll
                                                                                                                                                                                                              • API String ID: 3196525290-3399515747
                                                                                                                                                                                                              • Opcode ID: 8f659c9f5ffd7e4de4833b10bc0174f637ce64510f2568ddf306f0b466b77763
                                                                                                                                                                                                              • Instruction ID: fae4cee1ebcb470211c62aaabf75450365a4a8297c953079ddf2ddd3cc7c5b82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f659c9f5ffd7e4de4833b10bc0174f637ce64510f2568ddf306f0b466b77763
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6512075A00218AFDB55DB98CC85FDAB3B9EF8D700F104588F608EB290D7B0AE45CB64
                                                                                                                                                                                                              Function 00392220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 00392243
                                                                                                                                                                                                              • WSAStartup.WS2_32(00000202,?), ref: 00392257
                                                                                                                                                                                                                • Part of subcall function 00399300: inet_addr.WS2_32(n"9), ref: 00399308
                                                                                                                                                                                                                • Part of subcall function 00399300: gethostbyname.WS2_32(n"9), ref: 00399313
                                                                                                                                                                                                              • htons.WS2_32(00000050), ref: 00392288
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00392297
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 003922AE
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 003922C3
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 003922F4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00392307
                                                                                                                                                                                                              • send.WS2_32(00000000,00000000,00000400,00000000), ref: 00392344
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00392350
                                                                                                                                                                                                              • closesocket.WS2_32(00000000), ref: 00392363
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
                                                                                                                                                                                                              • String ID: gfff$i.root-servers.org
                                                                                                                                                                                                              • API String ID: 99835129-3534201491
                                                                                                                                                                                                              • Opcode ID: be2c2ab627f2fbd5b59743331e9118a09a8650578422d9ee9cd873601d19c251
                                                                                                                                                                                                              • Instruction ID: 055f7a77207427f2e7cf3613c83b058e29f381d99b681574d9cd4c44b8780121
                                                                                                                                                                                                              • Opcode Fuzzy Hash: be2c2ab627f2fbd5b59743331e9118a09a8650578422d9ee9cd873601d19c251
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1313BB2B006186BDF1AE66D9C82BBFB369CF85710F444565FA0CEB2C0EA709D4147D2
                                                                                                                                                                                                              Function 00399830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000003FF), ref: 00399850
                                                                                                                                                                                                              • strtok.MSVCRT(?,003A29EC), ref: 0039986E
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0039988B
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 003998A8
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A29EC), ref: 003998B5
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 003998D1
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 0039999C
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [UDP]: Finished flood on "%s:%d", xrefs: 00399970
                                                                                                                                                                                                              • [UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 0039993A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeap$strtok$lstrcpynmemset
                                                                                                                                                                                                              • String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
                                                                                                                                                                                                              • API String ID: 216847750-2644890838
                                                                                                                                                                                                              • Opcode ID: 6816c1e87e905060519e158ce941373e5b8539e681ad9391ceb8ef4bdeba79dc
                                                                                                                                                                                                              • Instruction ID: 12fd5319c0e0c6b97feba2cb4ecdda9abf6418f7bf0faf27b3289b61ff040a76
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6816c1e87e905060519e158ce941373e5b8539e681ad9391ceb8ef4bdeba79dc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A8313AF26003087BEB22A7A5BD46FAB336CEB47705F04016DFF08A6181D6719D0487B6
                                                                                                                                                                                                              Function 00398270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00398292
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 003982A8
                                                                                                                                                                                                                • Part of subcall function 003981C0: WSAStartup.WS2_32(00000202,?), ref: 003981E3
                                                                                                                                                                                                              • select.WS2_32(00000000,00000000,?,00000000,?), ref: 00398314
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Startupselect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3882035529-0
                                                                                                                                                                                                              • Opcode ID: e40105901cd5e5404db4970fb53fb1ea714fc6e93ffd19b2e37672d8536ceacf
                                                                                                                                                                                                              • Instruction ID: 583c33ab69719cf01ea3b401aa1e4d69b711610c4c0701f0c361fc611be708f6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e40105901cd5e5404db4970fb53fb1ea714fc6e93ffd19b2e37672d8536ceacf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A4A1E9B1900604ABDB35DF69D885AEBB3F8EF86310F00451DE68DC7241DB75AD85CBA1
                                                                                                                                                                                                              Function 0039AC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0039AC1A
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0039AC3E
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0039AC44
                                                                                                                                                                                                              • HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0039AC5E
                                                                                                                                                                                                              • HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0039AC79
                                                                                                                                                                                                              • lstrcmpW.KERNEL32(POST,00000000), ref: 0039AC85
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0039AC99
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000), ref: 0039ACB2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 770645459-1814004025
                                                                                                                                                                                                              • Opcode ID: 201dc8c1f126d057a230cd144f67523832412b3e939ec28c1a2ca9dfb50ed71b
                                                                                                                                                                                                              • Instruction ID: 46471551063eb68cd3b1eaaab3a92a241072824e98cb602495d8279beed0647a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 201dc8c1f126d057a230cd144f67523832412b3e939ec28c1a2ca9dfb50ed71b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 10217276601614BBDB229BA9EC88FAF7B7CEB86750F104255FA05E7240D630DD01DBE1
                                                                                                                                                                                                              Function 00399430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00399300: inet_addr.WS2_32(n"9), ref: 00399308
                                                                                                                                                                                                                • Part of subcall function 00399300: gethostbyname.WS2_32(n"9), ref: 00399313
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00399467
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00399490
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 003994BD
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 003994C1
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000002,00000011), ref: 003994F6
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00399511
                                                                                                                                                                                                              • sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 0039953C
                                                                                                                                                                                                              • Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 00399549
                                                                                                                                                                                                              • closesocket.WS2_32(?), ref: 00399559
                                                                                                                                                                                                              • GetTickCount.KERNEL32(?), ref: 00399564
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2400900511-0
                                                                                                                                                                                                              • Opcode ID: 986d4348892410ecb41e0ca8ac280e0989f15053ec31fa9a50169601398cb310
                                                                                                                                                                                                              • Instruction ID: 2ba654fb4fb8a5f65b68038f5086f15a8675dc956c24fcdebf35e2c8a77d1788
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 986d4348892410ecb41e0ca8ac280e0989f15053ec31fa9a50169601398cb310
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92313B729001246BDB22FBFD8C46BAEB39DDF8A304F12052AF945EB181D5709D05C7A2
                                                                                                                                                                                                              Function 00395820 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 171sleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000007FF,?,(m:), ref: 00395844
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 003958B9
                                                                                                                                                                                                              • InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 00395970
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00395A05
                                                                                                                                                                                                                • Part of subcall function 003949F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,003973CC,003C7C98,00000000,00000000,00000010,00000000), ref: 00394A10
                                                                                                                                                                                                                • Part of subcall function 003949F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00394A77
                                                                                                                                                                                                              • Sleep.KERNEL32(00000001), ref: 003959F9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CompareExchangeInterlockedMutexObjectReleaseSingleSleepWaitmemset
                                                                                                                                                                                                              • String ID: (m:$.`9$STFU
                                                                                                                                                                                                              • API String ID: 1355865062-557185520
                                                                                                                                                                                                              • Opcode ID: fb9ea8fc3d330910d8ace5f62a81f248a52a777fbfb55a97ae973f73d02ff2e1
                                                                                                                                                                                                              • Instruction ID: f2b80b371c1a24374145b1a103d8afec24ad002fe768c7b5624a0c59ee732325
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb9ea8fc3d330910d8ace5f62a81f248a52a777fbfb55a97ae973f73d02ff2e1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CE51A371E00215ABDB15DFA8CC45FAE77F8EB85710F148169F945EB280DB749E81CB90
                                                                                                                                                                                                              Function 00391000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,003DAC50), ref: 0039100D
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,003DAA28), ref: 00391054
                                                                                                                                                                                                              • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00391062
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(003A6D88,?), ref: 0039108B
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(003A6E90,?), ref: 00391093
                                                                                                                                                                                                                • Part of subcall function 00397700: memset.MSVCRT(?,00000000,000001FF), ref: 0039771E
                                                                                                                                                                                                                • Part of subcall function 00397700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 00397738
                                                                                                                                                                                                                • Part of subcall function 00397700: lstrlenA.KERNEL32(00000000), ref: 00397747
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
                                                                                                                                                                                                              • String ID: %s.%s$pdef$ruskill
                                                                                                                                                                                                              • API String ID: 4105673886-2574534833
                                                                                                                                                                                                              • Opcode ID: 6d8496a7acb1a39f76765323462c15ebddb3293168812a36a9c20a7ed0605e20
                                                                                                                                                                                                              • Instruction ID: a77872c5fb99a0ef6b70d69d5319efc043bb63ed0c72cbe32a87e6e297cacc54
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d8496a7acb1a39f76765323462c15ebddb3293168812a36a9c20a7ed0605e20
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF01FC7B34021177DB235B69BD46EEBBB9CDF5B761F090025F608E2281D661D840C271
                                                                                                                                                                                                              Function 00399C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • strtok.MSVCRT(?,003A29EC), ref: 00399C7C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 00399C9A
                                                                                                                                                                                                              • lstrcpyA.KERNEL32(003DB648,003A1335), ref: 00399CB3
                                                                                                                                                                                                              • lstrcpynA.KERNEL32(003DB648,00000000,00000200), ref: 00399CC4
                                                                                                                                                                                                              • strtok.MSVCRT(00000000,003A29EC), ref: 00399CDB
                                                                                                                                                                                                              • atoi.MSVCRT(00000000), ref: 00399CE8
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?), ref: 00399D73
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • [Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 00399CF9
                                                                                                                                                                                                              • [Slowloris]: Finished flood on "%s", xrefs: 00399D45
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
                                                                                                                                                                                                              • String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
                                                                                                                                                                                                              • API String ID: 1726920797-1250431664
                                                                                                                                                                                                              • Opcode ID: 1ab82f57babb4b25fd5ead9142059964f45c511c2f7b8bc8944c79a21f4e18fb
                                                                                                                                                                                                              • Instruction ID: f104044e37c66a2be5df64b7585aeccf875ce0b26b96480306af217cb0a57264
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ab82f57babb4b25fd5ead9142059964f45c511c2f7b8bc8944c79a21f4e18fb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6D212E77641744BFD713ABB4BC4AFA7779CE716712F01002EF608962D1D7B588008BA0
                                                                                                                                                                                                              Function 00398670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103C), ref: 00398688
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 003986AE
                                                                                                                                                                                                              • inet_ntoa.WS2_32(?), ref: 003986F7
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00398704
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00398713
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00398640,00000000,00000000,00000000), ref: 00398734
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0039873B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 30336511-0
                                                                                                                                                                                                              • Opcode ID: 54373445c3a5ab9f804d8d5aafac032ba1c2aac406e203a5da827e5a5acaf888
                                                                                                                                                                                                              • Instruction ID: 58ce50d0fc4dd305717c274423ec06dd5de5142850fe116c354da561c22a7508
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 54373445c3a5ab9f804d8d5aafac032ba1c2aac406e203a5da827e5a5acaf888
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 82212779600B009BD7239BB4ED0ABEA77E8EF4A340F004919F69DCB290DBB0A540CB55
                                                                                                                                                                                                              Function 00393440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 136COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • printf.MSVCRT(block_size: %d,?,003C7A80,?), ref: 003934A0
                                                                                                                                                                                                              • printf.MSVCRT(ngr->blocksize: %d,?,block_size: %d,?,003C7A80,?), ref: 003934AD
                                                                                                                                                                                                              • printf.MSVCRT(Done frst,?,?,?,?,003C7A80,?), ref: 003934CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: printf
                                                                                                                                                                                                              • String ID: Done frst$block_size: %d$ngr->blocksize: %d
                                                                                                                                                                                                              • API String ID: 3524737521-1816125109
                                                                                                                                                                                                              • Opcode ID: a78a4d184cc6e4fa1a087176915f568546e9e1bd7dcf805dc659a26b4dd4f12a
                                                                                                                                                                                                              • Instruction ID: ff12dcf5d74d5c4125b8730a939c4b2beb34b8fa4822ae2551a8aee9977524d9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a78a4d184cc6e4fa1a087176915f568546e9e1bd7dcf805dc659a26b4dd4f12a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F641E5B5A00204AFDF15DF69C885E9AB7A9EF89324F15C55DF9098B241E731EF01CB90
                                                                                                                                                                                                              Function 00392A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • htons.WS2_32(?), ref: 00392A44
                                                                                                                                                                                                                • Part of subcall function 00392460: GetProcessHeap.KERNEL32(?,003920DE,?), ref: 0039246C
                                                                                                                                                                                                                • Part of subcall function 00392460: HeapAlloc.KERNEL32(?,00000008,003920DE,?,003920DE,?), ref: 0039247E
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00392A8A
                                                                                                                                                                                                              • WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 00392A96
                                                                                                                                                                                                              • GetLastError.KERNEL32(00000002,00000001,00000006), ref: 00392A9B
                                                                                                                                                                                                                • Part of subcall function 003924A0: GetProcessHeap.KERNEL32(00000000,?,00392131,00000000), ref: 003924B4
                                                                                                                                                                                                                • Part of subcall function 003924A0: HeapFree.KERNEL32(?,00000000,1!9,00000000,?,00392131,00000000), ref: 003924C3
                                                                                                                                                                                                              • inet_ntoa.WS2_32(00000002), ref: 00392AEE
                                                                                                                                                                                                              • connect.WS2_32(00000000,?,00000010), ref: 00392AFC
                                                                                                                                                                                                              • Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 00392B0B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 268164981-0
                                                                                                                                                                                                              • Opcode ID: 18d7704bc2f37aa9aee01ce1c721dd645e6cb28687c904aa12301ea4ee7e21f7
                                                                                                                                                                                                              • Instruction ID: e494c3e305e25506b9f7b67bb94b489a678243009e2266274cf875f6ba7185ce
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18d7704bc2f37aa9aee01ce1c721dd645e6cb28687c904aa12301ea4ee7e21f7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D341E271E00A04ABDF22EFA8D881A6FB3B9EF55320F11456AE519DB341D6329941CBD1
                                                                                                                                                                                                              Function 00396E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00392460: GetProcessHeap.KERNEL32(?,003920DE,?), ref: 0039246C
                                                                                                                                                                                                                • Part of subcall function 00392460: HeapAlloc.KERNEL32(?,00000008,003920DE,?,003920DE,?), ref: 0039247E
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0039AFBD
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0039AFCB
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: memset.MSVCRT(?,00000000,000003FF), ref: 0039AFE8
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF), ref: 0039B002
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: lstrlenA.KERNEL32(?), ref: 0039B013
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: sscanf.MSVCRT(00000000,POST /%1023s,00000000,00000000,?,00000000), ref: 0039B02A
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: strtok.MSVCRT(00000000,003A2B84), ref: 0039B041
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: _memicmp.MSVCRT(00000000,Host: ,00000006), ref: 0039B05B
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: strtok.MSVCRT(00000000,003A2B84), ref: 0039B06E
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: lstrlenA.KERNEL32(00000000), ref: 0039B09B
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: lstrlenA.KERNEL32(00000000), ref: 0039B0AD
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: lstrlenA.KERNEL32(00000000), ref: 0039B0BB
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: lstrlenA.KERNEL32(00000000), ref: 0039B0C6
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: HeapAlloc.KERNEL32(?,00000000,?), ref: 0039B0D5
                                                                                                                                                                                                                • Part of subcall function 0039AFA0: _memicmp.MSVCRT(00000000,HTTP,00000004), ref: 0039B0EB
                                                                                                                                                                                                              • strstr.MSVCRT(00000000,003A19DC,?,?,?,?), ref: 00396EBC
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 00396EC9
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,?,?,?), ref: 00396EE7
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?), ref: 00396F1A
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,?,?,?), ref: 00396F2C
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?), ref: 00396F3C
                                                                                                                                                                                                                • Part of subcall function 0039B160: lstrlenA.KERNEL32(00396E9C,00000000,00000000,00000000,?,?,00396E9C), ref: 0039B178
                                                                                                                                                                                                                • Part of subcall function 0039B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00396E9C), ref: 0039B186
                                                                                                                                                                                                                • Part of subcall function 0039B160: lstrlenA.KERNEL32(00396E9C,?,?,00396E9C), ref: 0039B18F
                                                                                                                                                                                                                • Part of subcall function 0039B160: strstr.MSVCRT(00000000,,00000000,00396E9C,00000000,?,?,00396E9C), ref: 0039B19F
                                                                                                                                                                                                                • Part of subcall function 0039B160: strstr.MSVCRT(-00000004,003A19DC,?,?,?,00396E9C), ref: 0039B1B6
                                                                                                                                                                                                                • Part of subcall function 0039B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00396E9C), ref: 0039B1C3
                                                                                                                                                                                                                • Part of subcall function 0039B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00396E9C), ref: 0039B1D2
                                                                                                                                                                                                                • Part of subcall function 0039B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00396E9C), ref: 0039B1DC
                                                                                                                                                                                                                • Part of subcall function 0039B160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00396E9C), ref: 0039B1E5
                                                                                                                                                                                                                • Part of subcall function 0039B160: HeapFree.KERNEL32(?,00000000,00000000,?,?,?,00396E9C), ref: 0039B1F8
                                                                                                                                                                                                                • Part of subcall function 003A01E0: memset.MSVCRT(?,00000000,000001FF,00000000,00000000,00000000), ref: 003A0202
                                                                                                                                                                                                                • Part of subcall function 003A01E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 003A0213
                                                                                                                                                                                                                • Part of subcall function 003A01E0: EnterCriticalSection.KERNEL32(003DB4E4), ref: 003A0223
                                                                                                                                                                                                                • Part of subcall function 003A01E0: strstr.MSVCRT(00000000,003A19DC), ref: 003A0243
                                                                                                                                                                                                                • Part of subcall function 003A01E0: lstrlenA.KERNEL32(00000000), ref: 003A0254
                                                                                                                                                                                                                • Part of subcall function 003A01E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003A025F
                                                                                                                                                                                                                • Part of subcall function 003A01E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 003A0272
                                                                                                                                                                                                                • Part of subcall function 003A01E0: strstr.MSVCRT(00000000,), ref: 003A0281
                                                                                                                                                                                                                • Part of subcall function 003A01E0: _snprintf.MSVCRT(00000000,000001FF,%s=,003A32E4), ref: 003A02C8
                                                                                                                                                                                                                • Part of subcall function 003A01E0: strstr.MSVCRT(?,00000000), ref: 003A02EF
                                                                                                                                                                                                                • Part of subcall function 003A01E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 003A03E4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
                                                                                                                                                                                                              • String ID: POST
                                                                                                                                                                                                              • API String ID: 836748388-1814004025
                                                                                                                                                                                                              • Opcode ID: 4e2015abf4a410e0bde6347df04db61c1b30cf762194339c0c26b847db333381
                                                                                                                                                                                                              • Instruction ID: bd45a884454463ef9ab05ee3a7c078f506f790122d10f6ff35c919a6d8da8d0e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4e2015abf4a410e0bde6347df04db61c1b30cf762194339c0c26b847db333381
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB31B375A02204BBDF129FA5ED86EAF77BCEB84340F154029F90997201DA35ED1087A1
                                                                                                                                                                                                              Function 00397610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?), ref: 00397640
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 0039765C
                                                                                                                                                                                                              • _vsnprintf.MSVCRT(?,000001FF,00000000,00391732,?), ref: 0039767E
                                                                                                                                                                                                              • lstrcmpA.KERNEL32(?,bdns,?,?), ref: 003976A0
                                                                                                                                                                                                              • StrStrIA.SHLWAPI(?,00000000,?,?), ref: 003976B4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _snprintf_vsnprintflstrcmplstrlen
                                                                                                                                                                                                              • String ID: %s_$bdns
                                                                                                                                                                                                              • API String ID: 4220314296-741241040
                                                                                                                                                                                                              • Opcode ID: 042564cd60e33e8e56511dfd1738beda4bf66e7c0f1fbb1d2e9f2e6ec9482244
                                                                                                                                                                                                              • Instruction ID: 78de1651c0926bcdcd672157f520d655b9273f0f5bfb58f1b4771441b91c8eac
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 042564cd60e33e8e56511dfd1738beda4bf66e7c0f1fbb1d2e9f2e6ec9482244
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5621F276600619ABDF229F68EC85FEB73ACEB85710F040669FD18D7181E671DD0087E0
                                                                                                                                                                                                              Function 0039A64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0039E750,00000000,00000000,00000000), ref: 0039A659
                                                                                                                                                                                                              • MessageBoxA.USER32(00000000,This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!,ngrBot Error,00000030), ref: 0039A66F
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0039A678
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0039A680
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • ngrBot Error, xrefs: 0039A661
                                                                                                                                                                                                              • This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 0039A666
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateExitMessageObjectProcessSingleThreadWait
                                                                                                                                                                                                              • String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
                                                                                                                                                                                                              • API String ID: 2697768853-1169653777
                                                                                                                                                                                                              • Opcode ID: c350e477f9c63a47dec47be266118b51219807b2f05e984998d86ff4026f3f6f
                                                                                                                                                                                                              • Instruction ID: 6e2f28bed096f54d880374b86d0c1427f6bd168cd339208d0ebfc5d5a6f390fc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c350e477f9c63a47dec47be266118b51219807b2f05e984998d86ff4026f3f6f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80E09E357C4351B7E62397A45D0FF8535189B07F52F210600F325BD0D08AE461804759
                                                                                                                                                                                                              Function 00391C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 00391C6E
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00391CC6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00391CD9
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$CloseFileModuleWrite
                                                                                                                                                                                                              • String ID: CreateFileW$kernel32.dll
                                                                                                                                                                                                              • API String ID: 2352564674-2113957990
                                                                                                                                                                                                              • Opcode ID: 6d6729a9a3cbda58b51506e6c9dde697350552fe8daebb848c372012f9f63dcc
                                                                                                                                                                                                              • Instruction ID: d4053e25e1c8a537455ccc2349b6d65bd5488fbcca84ba59d1d39baa24379863
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d6729a9a3cbda58b51506e6c9dde697350552fe8daebb848c372012f9f63dcc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B0126F66402197FDB059FA9DC86FEB336DEB4A324F158218FA25A72C0D2705D0447A0
                                                                                                                                                                                                              Function 00397E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,0000103A), ref: 00397E2C
                                                                                                                                                                                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00397E63
                                                                                                                                                                                                              • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00397E7A
                                                                                                                                                                                                              • connect.WS2_32(?,00000008,00000010), ref: 00397E8B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocLocalconnectioctlsocketsocket
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3721573447-0
                                                                                                                                                                                                              • Opcode ID: c1e54c6927e965dbec49c5e5e27a85e7dc687c559f279cddcb303e13238c49c0
                                                                                                                                                                                                              • Instruction ID: 8c164eb77f2eb59501f1f9d9f37edadb8f6373164243e35aa86d4e4a47c4d9ea
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c1e54c6927e965dbec49c5e5e27a85e7dc687c559f279cddcb303e13238c49c0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A11E671A00704AFCB20DF69D809ED6B7A8EF49720F004699FA599B3D1D2B2A8548790
                                                                                                                                                                                                              Function 00395070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34synchronizationCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _snprintf.MSVCRT(?,00000104,%s-pid,003C7AE8), ref: 0039508F
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 003950A2
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003950AB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateMutexObjectSingleWait_snprintf
                                                                                                                                                                                                              • String ID: %s-pid
                                                                                                                                                                                                              • API String ID: 3057366584-2694366501
                                                                                                                                                                                                              • Opcode ID: 9319608d5bfd524d657fb9ce6fe6767c0a2485507addbecd9f3310fb4df3c2d5
                                                                                                                                                                                                              • Instruction ID: ecbee4dce62f56a79fd033c3df5683e0a73ebdf783b4390153b7ebef61f2cf10
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9319608d5bfd524d657fb9ce6fe6767c0a2485507addbecd9f3310fb4df3c2d5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28F0E2B5A4030467EF23E7709C8BF96325C9710711F110665FA14A62C0E9B19AD48BA1
                                                                                                                                                                                                              Function 0039E840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00397330: memset.MSVCRT(?,00000000,000001FF), ref: 00397351
                                                                                                                                                                                                                • Part of subcall function 00397330: lstrlenA.KERNEL32(?), ref: 00397369
                                                                                                                                                                                                                • Part of subcall function 00397330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 00397381
                                                                                                                                                                                                                • Part of subcall function 00397330: _vsnprintf.MSVCRT(00000000,000001FE,003A0AAD,?), ref: 003973A3
                                                                                                                                                                                                                • Part of subcall function 00397330: lstrlenA.KERNEL32(00000000), ref: 003973B2
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 0039E861
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0039E868
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
                                                                                                                                                                                                              • String ID: admin$isadmin
                                                                                                                                                                                                              • API String ID: 3136305548-1977506819
                                                                                                                                                                                                              • Opcode ID: 0266b041bdb92988fa3cdd5ac7a464df7e2f2f991cd9899512dace1e4b2e890a
                                                                                                                                                                                                              • Instruction ID: c25582f6719be09dab087a9c587c01ad714209c2dff8d0d800fda641a1deb351
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0266b041bdb92988fa3cdd5ac7a464df7e2f2f991cd9899512dace1e4b2e890a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6D012797D430076FA2227A06E0FF4A2248AB26F17F604420FB00BD1C5E9E0304049BA
                                                                                                                                                                                                              Function 0039A800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: strchr$CountSleepTick
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 735077530-0
                                                                                                                                                                                                              • Opcode ID: 0f2a038e1e1763937f919d319d17b87fbb23ee7d2d54cd44db471e1227705a45
                                                                                                                                                                                                              • Instruction ID: 21ddc1cf585b31e08e763ab0813c07472e2e905edb896a1af9bee44d786e12a8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0f2a038e1e1763937f919d319d17b87fbb23ee7d2d54cd44db471e1227705a45
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A3F028B62083045BDB12A2A8DC86A9A775EDBC57A1F040424FE0A8B201FD7ADE0542F3
                                                                                                                                                                                                              Function 003A0820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00394900: WaitForSingleObject.KERNEL32(00397495,000000FF,?,00000000,756F59EB,?,00397495), ref: 00394939
                                                                                                                                                                                                                • Part of subcall function 00394900: ReleaseMutex.KERNEL32(?,?,00397495), ref: 0039497C
                                                                                                                                                                                                              • lstrlenA.KERNEL32(00000000,?,?,00392696), ref: 003A084B
                                                                                                                                                                                                                • Part of subcall function 003973E0: memset.MSVCRT(?,00000000,000001FF), ref: 00397401
                                                                                                                                                                                                                • Part of subcall function 003973E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 00397419
                                                                                                                                                                                                                • Part of subcall function 003973E0: lstrlenA.KERNEL32(?), ref: 00397431
                                                                                                                                                                                                                • Part of subcall function 003973E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 00397449
                                                                                                                                                                                                                • Part of subcall function 003973E0: _vsnprintf.MSVCRT(?,000001FE,003A0A8E,?), ref: 0039746B
                                                                                                                                                                                                                • Part of subcall function 003973E0: lstrlenA.KERNEL32(?), ref: 0039747A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
                                                                                                                                                                                                              • String ID: %s_0x%08X$bmsn$msnmsg
                                                                                                                                                                                                              • API String ID: 3682388603-4225137719
                                                                                                                                                                                                              • Opcode ID: d6cf8e3401407443ff7ad6732d61285fa09acae4e8d20dbc9b71c109d0888603
                                                                                                                                                                                                              • Instruction ID: cbc053ded025dae7d5114e651155eb3c423aadf244ed300375b6d872b357494e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6cf8e3401407443ff7ad6732d61285fa09acae4e8d20dbc9b71c109d0888603
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92F06C76EA512977DA1276A46C03FFB775CCB03755F400291FD08E61C1E9D55E1102E1
                                                                                                                                                                                                              Function 0039BA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • memset.MSVCRT(?,00000000,000007FF), ref: 0039BA1E
                                                                                                                                                                                                              • wvsprintfA.USER32(00000000,00000000,00000000), ref: 0039BA42
                                                                                                                                                                                                                • Part of subcall function 0039B990: memset.MSVCRT(?,00000000,000003FF,00000000), ref: 0039B9AF
                                                                                                                                                                                                                • Part of subcall function 0039B990: EnterCriticalSection.KERNEL32(003DA6C8,?,?,00000000), ref: 0039B9BC
                                                                                                                                                                                                                • Part of subcall function 0039B990: wvsprintfA.USER32(00000000,?,00000000,?,?,00000000), ref: 0039B9D1
                                                                                                                                                                                                                • Part of subcall function 0039B990: LeaveCriticalSection.KERNEL32(003DA6C8,?,?,?,?,?,00000000), ref: 0039B9F2
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000B.00000002.617645344.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_11_2_390000_LMrDJmjGiVuMmdtVXtMTEmE.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CriticalSectionmemsetwvsprintf$EnterLeave
                                                                                                                                                                                                              • String ID: PPPPMSG %s :%s
                                                                                                                                                                                                              • API String ID: 3980427996-569775469
                                                                                                                                                                                                              • Opcode ID: 8a55570e94532b3c8a06cdf10e3bceff2af420e68bef4abfa2def03a9f51a3e5
                                                                                                                                                                                                              • Instruction ID: 932d3723ef5fccc83f2dc5bc7899e69e3e042968193f690bc022dd273ea25628
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8a55570e94532b3c8a06cdf10e3bceff2af420e68bef4abfa2def03a9f51a3e5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F0F03675D00109ABDF51EB54EC45FA6737CFB44701F0481A9F94857241FB74AA588FA1